CVE-2026-45676: OpenTelemetry eBPF Instrumentation DoS

CVE-2026-45676 Overview

CVE-2026-45676 affects OpenTelemetry eBPF Instrumentation (OBI), a project that provides eBPF-based instrumentation for the OpenTelemetry standard. Versions prior to 0.9.0 contain a flaw in the replacement ELF parser. The parser trusts section offsets, counts, and string offsets read from executable files without validation. A crafted local ELF binary can force OBI to dereference invalid section pointers or slice past string tables. The agent then panics while determining the process language, resulting in a denial-of-service condition. The issue is tracked under [CWE-20] (Improper Input Validation) and has been patched in version 0.9.0.

Critical Impact

A local user able to place a crafted ELF binary in a path observed by OBI can crash the instrumentation agent, disrupting telemetry collection across the host.

Affected Products

• OpenTelemetry eBPF Instrumentation (opentelemetry:ebpf_instrumentation) versions prior to 0.9.0
• Go-based OBI distributions matching CPE cpe:2.3:a:opentelemetry:ebpf_instrumentation:*:*:*:*:*:go:*:*
• Hosts running OBI as a process-language detection agent on Linux

Discovery Timeline

• 2026-06-02 - CVE-2026-45676 published to NVD
• 2026-06-03 - Last updated in NVD database

Technical Details for CVE-2026-45676

Vulnerability Analysis

OBI implements a replacement Executable and Linkable Format (ELF) parser to identify the language of a running process. The parser reads structural metadata directly from the ELF file, including section header offsets, section counts, and string table offsets. These values are consumed without bounds checking against the actual file size or table extents.

When OBI encounters a crafted ELF whose header fields point outside valid memory regions, the agent either dereferences an invalid section pointer or slices beyond the bounds of the string table. The Go runtime responds by panicking, terminating the OBI process and halting instrumentation on the host.

Root Cause

The root cause is improper input validation in the ELF parsing logic. The parser treats untrusted file content as authoritative metadata. It does not verify that section offsets fall within the file, that section counts are consistent with file size, or that string offsets remain inside the bounds of the string table. This pattern maps directly to [CWE-20].

Attack Vector

Exploitation requires local access with the ability to introduce an ELF binary that OBI will inspect. The attacker does not need elevated privileges beyond standard user-level execution rights on the host. There is no impact to confidentiality or integrity, but availability of the instrumentation agent is fully compromised when the panic occurs.

No public proof-of-concept or exploit code is currently available. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS probability is 0.02%, indicating low predicted likelihood of exploitation in the near term.

The vulnerability mechanism is described in the GitHub Security Advisory GHSA-wp73-mwgf-4jq9. Refer to the advisory for parser-level technical details.

Detection Methods for CVE-2026-45676

Indicators of Compromise

• Unexpected termination or panic stack traces from the OBI agent referencing ELF parsing or language detection routines.
• Gaps in OpenTelemetry instrumentation data correlated with the appearance of new or unusual executables on the host.
• Presence of malformed ELF files in directories where short-lived processes are typically executed by non-privileged users.

Detection Strategies

• Monitor OBI process lifecycle events and alert on repeated agent crashes or restarts on the same host.
• Inspect host logs for Go runtime panic messages originating from the OBI binary.
• Correlate telemetry collection gaps with process-creation events from local users to identify potential triggering binaries.

Monitoring Recommendations

• Track the running version of OBI across the fleet and flag any host still running a release earlier than 0.9.0.
• Enable file integrity monitoring on directories where local users can drop executables that OBI will parse.
• Forward OBI agent logs and host process telemetry to a centralized analytics platform for cross-host correlation.

How to Mitigate CVE-2026-45676

Immediate Actions Required

• Upgrade OBI to version 0.9.0 or later on every host where the agent is deployed.
• Inventory all systems running opentelemetry:ebpf_instrumentation and prioritize multi-tenant or shared hosts where local users can introduce arbitrary binaries.
• Review recent agent crashes for evidence of exploitation attempts prior to patching.

Patch Information

The maintainers fixed the issue in OBI version 0.9.0. The release notes are available at GitHub Release v0.9.0. Full advisory details, including affected code paths, are documented in the GitHub Security Advisory GHSA-wp73-mwgf-4jq9.

Workarounds

• Restrict local user ability to execute or stage untrusted ELF binaries on hosts running OBI until the upgrade is applied.
• Limit OBI's process observation scope to trusted workloads where feasible.
• Configure automated restart of the OBI agent so that single-shot panics do not result in prolonged telemetry loss while patching is in progress.

# Verify the installed OBI version and upgrade if older than 0.9.0
obi --version
# Upgrade to the patched release (example for binary distribution)
curl -L https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/releases/tag/v0.9.0 -o obi-v0.9.0
systemctl restart obi