CVE-2026-42191 Details
Description
OpenTelemetry.Exporter.OpenTelemetryProtocol is the OTLP (OpenTelemetry Protocol) exporter implementation. From 1.8.0 to 1.15.2, the OTLP disk retry feature in OpenTelemetry.Exporter.OpenTelemetryProtocol silently fell back to Path.GetTempPath() when OTEL_DOTNET_EXPERIMENTAL_OTLP_RETRY=disk was set but OTEL_DOTNET_EXPERIMENTAL_OTLP_DISK_RETRY_DIRECTORY_PATH was not configured. The exporter stored and loaded *.blob files under fixed, signal-named subdirectories (traces, metrics, logs) beneath that shared temporary root path. On multi-user systems where the temporary directory is accessible to other local accounts, this allows an attacker to write crafted *.blob files, read *.blob files written by the application between export failures, or deposit numerous or oversized blob files, degrading retry-loop performance or consuming disk space. This vulnerability is fixed in 1.15.3.
A vulnerability exists in the OpenTelemetry.Exporter.OpenTelemetryProtocol package, specifically in versions 1.8.0 prior to 1.15.2. The issue arises in the OTLP disk retry feature, which, when configured to use disk retries without a specified directory path, defaults to a temporary directory accessible to other local users. This behavior can be exploited on multi-user systems to inject, read, or manipulate blob files containing telemetry data, potentially leading to unauthorized disclosure of information, degradation of application performance, or excessive consumption of disk space.
Users can upgrade to OpenTelemetry.Exporter.OpenTelemetryProtocol version 1.15.3 or later. If an immediate upgrade is not possible, avoid enabling disk retry in shared environments, configure a dedicated directory with strict access controls, ensure the directory is not shared across users, and monitor for unexpected blob files or abnormal growth in the retry backlog.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/open-telemetry/opentelemetry-dotnet/pull/7106 | [email protected] | Issue TrackingPatch |
| https://github.com/open-telemetry/opentelemetry-dotnet/security/advisories/GHSA-4625-4j76-fww9 | [email protected] | MitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-379 | Creation of Temporary File in Directory with Insecure Permissions | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| opentelemetry opentelemetry.exporter.opentelemetryprotocol | >= 1.8.0, < 1.15.3 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 26, 2026 | Initial Analysis | [email protected] |
| May 12, 2026 | New CVE Received | [email protected] |