open-telemetry opentelemetry-dotnet up to 1.15.2 Path.GetTempPath temp file

Summaryinfo

A vulnerability labeled as problematic has been found in open-telemetry opentelemetry-dotnet up to 1.15.2. This affects the function Path.GetTempPath. Such manipulation leads to temp file. This vulnerability is listed as CVE-2026-42191. The attack must be carried out locally. There is no available exploit. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in open-telemetry opentelemetry-dotnet up to 1.15.2. It has been rated as problematic. Affected by this issue is the function Path.GetTempPath. The manipulation with an unknown input leads to a temp file vulnerability. Using CWE to declare the problem leads to CWE-379. The product creates a temporary file in a directory whose permissions allow unintended actors to determine the file's existence or otherwise access that file. Impacted is confidentiality, integrity, and availability. CVE summarizes:

OpenTelemetry.Exporter.OpenTelemetryProtocol is the OTLP (OpenTelemetry Protocol) exporter implementation. From 1.8.0 to 1.15.2, the OTLP disk retry feature in OpenTelemetry.Exporter.OpenTelemetryProtocol silently fell back to Path.GetTempPath() when OTEL_DOTNET_EXPERIMENTAL_OTLP_RETRY=disk was set but OTEL_DOTNET_EXPERIMENTAL_OTLP_DISK_RETRY_DIRECTORY_PATH was not configured. The exporter stored and loaded *.blob files under fixed, signal-named subdirectories (traces, metrics, logs) beneath that shared temporary root path. On multi-user systems where the temporary directory is accessible to other local accounts, this allows an attacker to write crafted *.blob files, read *.blob files written by the application between export failures, or deposit numerous or oversized blob files, degrading retry-loop performance or consuming disk space. This vulnerability is fixed in 1.15.3.

The advisory is available at github.com. This vulnerability is handled as CVE-2026-42191 since 04/25/2026. The exploitation is known to be difficult. Local access is required to approach this attack. Technical details are known, but there is no available exploit.

Upgrading to version 1.15.3 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• open-telemetry

Name

• opentelemetry-dotnet

Version

• 1.15.0
• 1.15.1
• 1.15.2

Website

• Product: https://github.com/open-telemetry/opentelemetry-dotnet/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion