OpenTelemetry OBI CVE-2026-45683

Java TLS instrumentation must be explicitly enabled in the OBI deployment - this is not a default-on feature in all configurations, so defenders should verify their OBI config before assessing exposure. The attacker must hold a local authenticated session on the OBI host (CVSS PR:L confirms authenticated local access is required; unauthenticated remote exploitation is not possible). The host must be running OBI version less than 0.9.0 with the do_vfs_ioctl kprobe loaded. Any local process can issue ioctl syscalls without elevated privilege, satisfying that step. For kernel bytes to be disclosed, the supplied kernel address must reference readable kernel memory and the first few bytes must satisfy enough of the Java TLS structure (operation byte valid, length field greater than zero) to pass early BPF checks - the PoC notes partial satisfaction may be sufficient. Exploitation is further constrained by telemetry access: the disclosed bytes are emitted into the OBI telemetry ring buffer rather than returned directly to the calling process, so the attacker needs visibility into the OBI telemetry pipeline (or a cooperating observer) to recover the exfiltrated content.

CVSS 3.8 (AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) reflects a local, low-complexity, low-privilege attack with Scope:Changed - meaning the impact crosses from the attacker's user-space process into the kernel memory domain and the privileged OBI telemetry pipeline. The Scope:Changed designation is materially significant: even though raw CVSS severity is low, the attacker gains a read primitive against kernel memory, which may contain credentials, encryption keys, or process secrets. EPSS data is absent from available intelligence, so quantitative exploitation probability cannot be assessed. No CISA KEV listing exists, but the presence of a working PoC in the published security advisory substantially lowers the exploitation bar for any local attacker. In security-sensitive or multi-tenant environments - precisely where eBPF observability tooling like OBI is commonly deployed - the ability to exfiltrate kernel memory into an observable telemetry stream represents a disproportionate risk relative to the base CVSS score. For standard single-tenant deployments where local access is tightly controlled, real-world risk is lower. The CVSS attack complexity of Low and no user interaction requirement mean that once the conditions are met, exploitation is straightforward and repeatable.

A developer or service account with a standard local shell session on an OBI-instrumented host compiles the PoC (published verbatim in GHSA-fjq3-ffvr-vm46) and runs it, issuing ioctl(0, 0x0b10b1, 0xffff888000000000) - the Java TLS magic command with a crafted kernel virtual address. The OBI kprobe intercepts the call in do_vfs_ioctl and uses bpf_probe_read to copy bytes from that kernel address into its buffer, then emits the result through bpf_ringbuf_output into the OBI telemetry pipeline. The attacker then reads the disclosed kernel bytes from the telemetry stream, potentially recovering secrets or memory layout information resident in the kernel at that address.