CVE-2026-41433

OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. From 0.4.0 to before 0.8.0, a flaw in the Java agent injection path allows a local attacker controlling a Java workload to overwrite arbitrary host files when Java injection is enabled and OBI is running with elevated privileges. The injector trusted TMPDIR from the target process and used unsafe file creation semantics, enabling both filesystem boundary escape and symlink-based file clobbering. This vulnerability is fixed in 0.8.0.

• CWE-22
• CWE-59

• https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/releases/tag/v0.8.0Release Notes
• https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/security/advisories/GHSA-8gmg-3w2q-65f4Exploit, Third Party Advisory
• https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/security/advisories/GHSA-8gmg-3w2q-65f4Exploit, Third Party Advisory

Published

Apr 24, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-41428Budibase is an open-source low-code platform. Prior to 3.35.…9.1
• CVE-2026-41429arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ES…8.8
• CVE-2026-4143The Neos Connector for Fakturama plugin for WordPress is vul…4.3
• CVE-2026-41430Press, a Frappe custom app that runs Frappe Cloud, manages i…6.1
• CVE-2026-41431Zen is a firefox-based browser. Prior to 1.19.9b, Zen Browse…8
• CVE-2026-41432New API is a large language mode (LLM) gateway and artificia…8.2
• CVE-2026-41434OP-TEE is a Trusted Execution Environment (TEE) designed as …3.3
• CVE-2026-41445KissFFT before commit 8a8e66e contains an integer overflow v…8.8
• CVE-2026-41446Snap One WattBox 800 and 820 series firmware versions prior …9.8
• CVE-2026-41447FirmaCheck for Windows before 1.3.16 contains a DLL hijackin…8.5
• CVE-2026-41448AdGuard Home, when started with the --glinet flag, contains …9.4
• CVE-2026-4145During an internal security assessment, a potential vulnerab…8.5