https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 20:12:13 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-324041 EUVD-2026-324041 https://cve.radiocsirt.org/vuln/euvd-2026-324041 https://cve.radiocsirt.org/vuln/fkie_cve-2026-45679 <p>OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, OBI exports raw Redis error text as the span status message. Because Redis error replies can contain attacker-controlled or sensitive values, this behavior can exfiltrate tokens, PII, or other confidential input into telemetry backends and inject untrusted text into downstream analysis systems. This issue has been patched in version 0.9.0.</p> <p>OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, OBI exports raw Redis error text as the span status message. Because Redis error replies can contain attacker-controlled or sensitive values, this behavior can exfiltrate tokens, PII, or other confidential input into telemetry backends and inject untrusted text into downstream analysis systems. This issue has been patched in version 0.9.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-45679 https://cve.radiocsirt.org/vuln/ghsa-8rrq-wcg8-cv5q <p><strong>Affected:</strong> Go: go.opentelemetry.io/obi</p> <p>### Summary</p> <p>OBI exports raw Redis error text as the span status message. Because Redis error replies can contain attacker-controlled or sensitive values, this behavior can exfiltrate tokens, PII, or other confidential input into telemetry backends and inject untrusted text into downstream analysis systems.</p> <p>### Details</p> <p>In [pkg/ebpf/common/redis_detect_transform.go](https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/blob/4f35facce2fe611319672595838ab875490f404d/pkg/components/ebpf/common/redis_detect_transform.go#L60-L74), `getRedisError` trims the raw error buffer and stores it directly in `request.DBError.Description`.</p> <p>Later, [pkg/appolly/app/request/span.go](https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/blob/4f35facce2fe611319672595838ab875490f404d/pkg/app/request/span.go#L347-L352) returns that description as the exported status message for Redis spans whenever the span status is non-zero.</p> <p>There is no opt-in control or sanitization beyond CRLF trimming. As a result, raw Redis error text becomes part of OTLP-exported status metadata by default.</p> <p>### PoC</p> <p>Local request-layer testing recorded a status message containing `ERR invalid password for user bob secret=TOPSECRET`, which shows that unfiltered Redis error text reaches the exported status message.</p> <p>Use a vulnerable build:</p> <p>```bash git checkout v0.0.0-rc.1+build make build ```</p> <p>Start Redis and OBI:</p> <p>```bash docker run --rm -p 6379:6379 redis:7 sudo ./bin/obi ```</p> <p>Send a comma…</p> <p><strong>Affected:</strong> Go: go.opentelemetry.io/obi</p> <p>### Summary</p> <p>OBI exports raw Redis error text as the span status message. Because Redis error replies can contain attacker-controlled or sensitive values, this behavior can exfiltrate tokens, PII, or other confidential input into telemetry backends and inject untrusted text into downstream analysis systems.</p> <p>### Details</p> <p>In [pkg/ebpf/common/redis_detect_transform.go](https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/blob/4f35facce2fe611319672595838ab875490f404d/pkg/components/ebpf/common/redis_detect_transform.go#L60-L74), `getRedisError` trims the raw error buffer and stores it directly in `request.DBError.Description`.</p> <p>Later, [pkg/appolly/app/request/span.go](https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/blob/4f35facce2fe611319672595838ab875490f404d/pkg/app/request/span.go#L347-L352) returns that description as the exported status message for Redis spans whenever the span status is non-zero.</p> <p>There is no opt-in control or sanitization beyond CRLF trimming. As a result, raw Redis error text becomes part of OTLP-exported status metadata by default.</p> <p>### PoC</p> <p>Local request-layer testing recorded a status message containing `ERR invalid password for user bob secret=TOPSECRET`, which shows that unfiltered Redis error text reaches the exported status message.</p> <p>Use a vulnerable build:</p> <p>```bash git checkout v0.0.0-rc.1+build make build ```</p> <p>Start Redis and OBI:</p> <p>```bash docker run --rm -p 6379:6379 redis:7 sudo ./bin/obi ```</p> <p>Send a comma…</p> https://cve.radiocsirt.org/vuln/ghsa-8rrq-wcg8-cv5q https://cve.radiocsirt.org/vuln/opensuse-su-2026:11803-1 <p>alloy-1.19.2-1.1 on GA media</p> <p>alloy-1.19.2-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:11803-1