OpenTelemetry eBPF Instrumentation: Java injection path lets a workload overwrite arbitrary host files

Impact

OBI runs as a privileged node-level observability agent. Its Java agent injector trusted the TMPDIR environment variable of the target process and created files unsafely, so a tenant who controls a Java workload can point the injector outside its data root and clobber arbitrary files on the host through symlinks. On a GPU fleet the practical result is host integrity loss from inside a container: overwrite a kubelet or systemd unit, a device-plugin config, or an SSH authorized_keys file, and the node is compromised rather than merely noisy. The CVSS vector marks scope change with high integrity and availability impact, which matches an agent-to-host escape. Only affects deployments with Java injection enabled and OBI running privileged.

Who can reach it

Local - an attacker who controls a Java workload instrumented by OBI (for example any tenant able to run a pod on an instrumented node). Requires OBI to be running with elevated privileges and Java injection enabled; no separate authentication to OBI is needed.

What to do

Upgrade OBI to 0.8.0 and restart the agent DaemonSet - a rolling restart of the collector pods, no node drain or reboot. If you cannot upgrade immediately, disable Java agent injection or stop running the injector with elevated privileges.

References

Related entries

• Renovate (kustomize manager): chart names are injected into helm pull commands, running attacker shell commandsCVE-2026-76229 · Renovate (kustomize manager, helm pull)High
• Renovate (helmv3 manager): repository value from Chart.yaml is injected into helm registry login commandsCVE-2026-76232 · Renovate (helmv3 manager, helm registry login)High
• Vertiv Avocent UMG-4000 universal management gateway: Every command the UMG-4000's web interface runs executes as rootCVE-2019-9507 · Vertiv Avocent UMG-4000 universal management gatewayHigh
• Eaton Intelligent Power Manager (IPM) prior to 1.69 - dynamic eval: Unauthenticated eval injection: user-controlledCVE-2021-23277 · Eaton Intelligent Power Manager (IPM) prior to 1.69 - dynamic evalHigh
• Intel C++ Compiler Classic / oneAPI toolkits (Unicode source handling): Improper handling of Unicode bidirectionalCVE-2022-25987 · Intel C++ Compiler Classic / oneAPI toolkits (Unicode source handling)High
• Intel oneAPI DPC++/C++ compiler (homoglyph rendering): Homoglyph characters are not visually distinguishedCVE-2022-26843 · Intel oneAPI DPC++/C++ compiler (homoglyph rendering)High