PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-42191 open-telemetry CVE debrief

OpenTelemetry.Exporter.OpenTelemetryProtocol versions 1.8.0 through 1.15.2 contain a vulnerability in the experimental OTLP disk retry feature. When `OTEL_DOTNET_EXPERIMENTAL_OTLP_RETRY=disk` is enabled without explicitly configuring `OTEL_DOTNET_EXPERIMENTAL_OTLP_DISK_RETRY_DIRECTORY_PATH`, the exporter silently falls back to `Path.GetTempPath()` for storing retry data. This creates a shared, predictable directory structure (with fixed subdirectories named `traces`, `metrics`, and `logs`) that is accessible to other local users on multi-user systems. The vulnerability allows local attackers to read sensitive telemetry data from blob files, inject malicious blob files that may be processed on retry, or conduct resource exhaustion attacks through disk space consumption or performance degradation. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L) reflects local attack vector, high attack complexity due to required conditions, low privileges needed, and high impacts to confidentiality and integrity with low availability impact. The issue is classified under CWE-379 (Creation of Temporary File in Directory with Incorrect Permissions).

Vendor
open-telemetry
Product
opentelemetry-dotnet
CVSS
MEDIUM 6.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-12
Original CVE updated
2026-05-26
Advisory published
2026-05-12
Advisory updated
2026-05-26

Who should care

Organizations running .NET applications with OpenTelemetry OTLP exporters on multi-user systems or shared hosting environments; DevOps teams using experimental disk retry features for telemetry reliability; security teams monitoring for local privilege escalation vectors in observability infrastructure; cloud platform operators providing .NET runtime environments to multiple tenants

Technical summary

The OpenTelemetry .NET OTLP exporter's experimental disk retry mechanism creates a security boundary failure when the retry directory is not explicitly configured. The exporter writes serialized telemetry data as *.blob files to signal-specific subdirectories (traces/, metrics/, logs/) under the system temporary path. On Windows, this typically resolves to %TEMP% (user-isolated but potentially accessible to elevated processes); on Linux/Unix systems with shared /tmp or /var/tmp, the exposure is broader. The fallback behavior is silent—no warning is emitted when the environment variable for custom path is absent. An attacker with local access can exploit the predictable path structure to: (1) exfiltrate telemetry data containing potentially sensitive operational information from read operations on blob files; (2) poison the retry queue by writing malformed or malicious blob files that may cause parsing failures or unexpected behavior on export retry; (3) cause denial of service through disk quota exhaustion or retry loop performance degradation via file system operations on numerous large blob files. The fix in 1.15.3 requires explicit directory configuration when disk retry is enabled, eliminating the silent insecure fallback.

Defensive priority

medium

Recommended defensive actions

  • Upgrade OpenTelemetry.Exporter.OpenTelemetryProtocol to version 1.15.3 or later
  • If using the experimental disk retry feature, explicitly configure OTEL_DOTNET_EXPERIMENTAL_OTLP_DISK_RETRY_DIRECTORY_PATH to a secure, application-private directory with restricted permissions
  • Review and clear any existing *.blob files from shared temporary directories that may have been created by affected versions
  • Audit systems for unauthorized blob files in Path.GetTempPath() subdirectories named traces, metrics, or logs
  • Consider disabling disk retry (remove OTEL_DOTNET_EXPERIMENTAL_OTLP_RETRY environment variable) if not strictly required until upgrade is complete
  • Apply principle of least privilege to service accounts running applications with OTLP exporters

Evidence notes

Vulnerability confirmed through NVD analysis with vendor advisory and patch references from OpenTelemetry .NET repository. Affected versions precisely bounded: 1.8.0 inclusive through 1.15.2 inclusive, fixed in 1.15.3.

Official resources

2026-05-12