{"id":"EUVD-2026-29784","enisaUuid":"5b719df2-8f8d-346e-9aff-499686e072e2","description":"OpenTelemetry.Exporter.OpenTelemetryProtocol is the OTLP (OpenTelemetry Protocol) exporter implementation. From 1.8.0 to 1.15.2, the OTLP disk retry feature in OpenTelemetry.Exporter.OpenTelemetryProtocol silently fell back to Path.GetTempPath() when OTEL_DOTNET_EXPERIMENTAL_OTLP_RETRY\u003ddisk was set but OTEL_DOTNET_EXPERIMENTAL_OTLP_DISK_RETRY_DIRECTORY_PATH was not configured. The exporter stored and loaded *.blob files under fixed, signal-named subdirectories (traces, metrics, logs) beneath that shared temporary root path. On multi-user systems where the temporary directory is accessible to other local accounts, this allows an attacker to write crafted *.blob files, read *.blob files written by the application between export failures, or deposit numerous or oversized blob files, degrading retry-loop performance or consuming disk space. This vulnerability is fixed in 1.15.3.","datePublished":"May 12, 2026, 7:12:03 PM","dateUpdated":"May 13, 2026, 2:16:18 PM","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L","references":"https://github.com/open-telemetry/opentelemetry-dotnet/security/advisories/GHSA-4625-4j76-fww9\nhttps://github.com/open-telemetry/opentelemetry-dotnet/pull/7106\n","aliases":"CVE-2026-42191\nGHSA-4625-4j76-fww9\n","assigner":"GitHub_M","epss":0.11,"enisaIdProduct":[{"id":"e75d92ee-e480-33c3-988d-c08dd3897639","product":{"name":"opentelemetry-dotnet","vendor":{"name":"open-telemetry"}},"product_version":"1.8.0, \u003c 1.15.3"}],"enisaIdVendor":[{"id":"552e4d07-a34f-33bc-9b9e-ccac4d3d5748","vendor":{"name":"open-telemetry"}}],"enisaIdVulnerability":[{"id":"2c09f2b8-5c5e-35a9-8799-c69109780a93","vulnerability":{"id":"GHSA-4625-4j76-fww9","description":"OpenTelemetry\u0027s disk retry default temp path enables local blob injection via OTLP Exporter","datePublished":"Apr 30, 2026, 6:34:30 PM","dateUpdated":"May 13, 2026, 4:27:20 PM","baseScore":0.0,"references":"https://github.com/open-telemetry/opentelemetry-dotnet/security/advisories/GHSA-4625-4j76-fww9\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-42191\nhttps://github.com/open-telemetry/opentelemetry-dotnet/pull/7106\nhttps://github.com/open-telemetry/opentelemetry-dotnet/commit/78dffdc5ebdf3dc090fdb94e3f1a32d3d1e26dfd\nhttps://github.com/open-telemetry/opentelemetry-dotnet\n","enisa_id":"EUVD-2026-29784\n","aliases":"CVE-2026-42191\nGHSA-4625-4j76-fww9\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:00:21 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"c13f1315-d2a2-31d7-a064-f7bc0a89c671","vulnerability":{"id":"CVE-2026-42191","description":"OpenTelemetry.Exporter.OpenTelemetryProtocol is the OTLP (OpenTelemetry Protocol) exporter implementation. From 1.8.0 to 1.15.2, the OTLP disk retry feature in OpenTelemetry.Exporter.OpenTelemetryProtocol silently fell back to Path.GetTempPath() when OTEL_DOTNET_EXPERIMENTAL_OTLP_RETRY\u003ddisk was set but OTEL_DOTNET_EXPERIMENTAL_OTLP_DISK_RETRY_DIRECTORY_PATH was not configured. The exporter stored and loaded *.blob files under fixed, signal-named subdirectories (traces, metrics, logs) beneath that shared temporary root path. On multi-user systems where the temporary directory is accessible to other local accounts, this allows an attacker to write crafted *.blob files, read *.blob files written by the application between export failures, or deposit numerous or oversized blob files, degrading retry-loop performance or consuming disk space. This vulnerability is fixed in 1.15.3.","datePublished":"May 12, 2026, 7:12:03 PM","dateUpdated":"May 13, 2026, 2:16:18 PM","status":"PUBLISHED","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L","references":"https://github.com/open-telemetry/opentelemetry-dotnet/security/advisories/GHSA-4625-4j76-fww9\nhttps://github.com/open-telemetry/opentelemetry-dotnet/pull/7106\n","enisa_id":"EUVD-2026-29784\n","assigner":"GitHub_M","epss":0.11,"dataProcessed":"Nov 5, 2026, 7:17:24 AM","vulnerabilityProduct":[{"id":"5281e6a1-039f-322c-962a-c1fc1c728871","product":{"name":"opentelemetry-dotnet","vendor":{"name":"open-telemetry"}},"product_version":"1.8.0, \u003c 1.15.3"}],"vulnerabilityVendor":[{"id":"dd532874-5645-3d13-80d0-62d9cb383f51","vendor":{"name":"open-telemetry"}}]}}],"enisaIdAdvisory":[]}