EUVD-2026-25620
GHSA-8gmg-3w2q-65f4
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H
Lifecycle Timeline
7DescriptionNVD
OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. From 0.4.0 to before 0.8.0, a flaw in the Java agent injection path allows a local attacker controlling a Java workload to overwrite arbitrary host files when Java injection is enabled and OBI is running with elevated privileges. The injector trusted TMPDIR from the target process and used unsafe file creation semantics, enabling both filesystem boundary escape and symlink-based file clobbering. This vulnerability is fixed in 0.8.0.
AnalysisAI
OpenTelemetry eBPF Instrumentation versions 0.4.0 through 0.7.x allow local attackers controlling a Java workload to overwrite arbitrary host files via path traversal when Java injection is enabled and the agent runs with elevated privileges. The vulnerability exploits unsafe file creation in the Java agent injection path, where the injector trusts the target process's TMPDIR environment variable and lacks boundary checks, enabling symlink-based file clobbering and filesystem escape. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Identify all deployments of OpenTelemetry eBPF Instrumentation versions 0.4.0-0.7.x in your environment using asset inventory or container scanning tools. Within 7 days: Upgrade all affected instances to version 0.8.0 or later per vendor advisory; if immediate patching is impossible, disable Java injection or restrict the agent to run without elevated privileges. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today