Skip to content
OpenAdvisories
Medium · 6.5 CVE-2026-42191 EUVD-2026-29784GHSA-4625-4j76-fww9

OpenTelemetry.Exporter.OpenTelemetryProtocol: Disk retry default temp path enables local blob injection for OTLP Exporter

Published May 12, 2026 · Updated May 13, 2026 · Assigned by GitHub_M

Description

OpenTelemetry.Exporter.OpenTelemetryProtocol is the OTLP (OpenTelemetry Protocol) exporter implementation. From 1.8.0 to 1.15.2, the OTLP disk retry feature in OpenTelemetry.Exporter.OpenTelemetryProtocol silently fell back to Path.GetTempPath() when OTEL_DOTNET_EXPERIMENTAL_OTLP_RETRY=disk was set but OTEL_DOTNET_EXPERIMENTAL_OTLP_DISK_RETRY_DIRECTORY_PATH was not configured. The exporter stored and loaded *.blob files under fixed, signal-named subdirectories (traces, metrics, logs) beneath that shared temporary root path. On multi-user systems where the temporary directory is accessible to other local accounts, this allows an attacker to write crafted *.blob files, read *.blob files written by the application between export failures, or deposit numerous or oversized blob files, degrading retry-loop performance or consuming disk space. This vulnerability is fixed in 1.15.3.

Affected products

VendorProductAffectedFixed
open-telemetry opentelemetry-dotnet >= 1.8.0, < 1.15.3 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling promitor 2.15.0-r1 —

Affected packages

EcosystemPackageAffectedFixedRecord
NuGet OpenTelemetry.Exporter.OpenTelemetryProtocol >= 1.8.0, < 1.15.3 1.15.3 GHSA-4625-4j76-fww9

References