CVE-2026-41433: OpenTelemetry eBPF Instrumentation: Privileged Java agent injection allows arbitrary host file overwrite via untrusted TMPDIR
(updated )
A flaw in the Java agent injection path allows a local attacker controlling a Java workload to overwrite arbitrary host files when Java injection is enabled and OBI is running with elevated privileges. The injector trusted TMPDIR from the target process and used unsafe file creation semantics, enabling both filesystem boundary escape and symlink-based file clobbering.
References
- github.com/advisories/GHSA-8gmg-3w2q-65f4
- github.com/open-telemetry/opentelemetry-ebpf-instrumentation
- github.com/open-telemetry/opentelemetry-ebpf-instrumentation/releases/tag/v0.8.0
- github.com/open-telemetry/opentelemetry-ebpf-instrumentation/security/advisories/GHSA-8gmg-3w2q-65f4
- nvd.nist.gov/vuln/detail/CVE-2026-41433
Code Behaviors & Features
Detect and mitigate CVE-2026-41433 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →