CVE-2026-42191

OpenTelemetry.Exporter.OpenTelemetryProtocol is the OTLP (OpenTelemetry Protocol) exporter implementation. From 1.8.0 to 1.15.2, the OTLP disk retry feature in OpenTelemetry.Exporter.OpenTelemetryProtocol silently fell back to Path.GetTempPath() when OTEL_DOTNET_EXPERIMENTAL_OTLP_RETRY=disk was set but OTEL_DOTNET_EXPERIMENTAL_OTLP_DISK_RETRY_DIRECTORY_PATH was not configured. The exporter stored and loaded *.blob files under fixed, signal-named subdirectories (traces, metrics, logs) beneath that shared temporary root path. On multi-user systems where the temporary directory is accessible to other local accounts, this allows an attacker to write crafted *.blob files, read *.blob files written by the application between export failures, or deposit numerous or oversized blob files, degrading retry-loop performance or consuming disk space. This vulnerability is fixed in 1.15.3.

• CWE-379

• https://github.com/open-telemetry/opentelemetry-dotnet/pull/7106Issue Tracking, Patch
• https://github.com/open-telemetry/opentelemetry-dotnet/security/advisories/GHSA-4625-4j76-fww9Mitigation, Vendor Advisory

Published

May 12, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-42185People is an application to handle users and teams, and dist…5.5
• CVE-2026-42186OpenBao is an open source identity-based secrets management …7.5
• CVE-2026-42188Geyser is a bridge between Minecraft: Bedrock Edition and Mi…2.4
• CVE-2026-42189Russh is a Rust SSH client & server library. Prior to versio…7.5
• CVE-2026-4219A flaw has been found in INDEX Conferences & Exhibitions Org…3.3
• CVE-2026-42190RedwoodSDK is a server-first React framework. From version 1…5.3
• CVE-2026-42192Plunk is an open-source email platform built on top of AWS S…5.4
• CVE-2026-42193Plunk is an open-source email platform built on top of AWS S…9.1
• CVE-2026-42194Admidio is an open-source user management solution. Prior to…6.8
• CVE-2026-42195draw.io is a configurable diagramming and whiteboarding appl…3.4
• CVE-2026-42196django-s3file is a lightweight file upload input for Django …9.9
• CVE-2026-42197RELATE is a web-based courseware package. Versions prior to …8.7