PT-2026-35073

CVE-2026-41433

Published

2026-04-17

Updated

2026-07-30

Description by

CVSS 3.1

8.4

High

MetricsAV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenTelemetry eBPF Instrumentation versions 0.4.0 through 0.7.x

Description A flaw in the Java agent injection path allows a local attacker controlling a Java workload to overwrite arbitrary host files when Java injection is enabled and the instrumentation is running with elevated privileges. The injector trusted the TMPDIR variable from the target process and used unsafe file creation semantics, which enables filesystem boundary escape and symlink-based file clobbering.

Recommendations Update to version 0.8.0.

Exploitability

Exploit

Fix

Impacts

Researchers

Mralias

Vendors

Affected products

Weakness enumeration

CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\'Path Traversal\')

CWE-59: Improper Link Resolution Before File Access (\'Link Following\')