OpenTelemetry up to 1.44.x privilege escalation

Summaryinfo

A vulnerability classified as critical was found in OpenTelemetry up to 1.44.x. This affects an unknown function. The manipulation results in Remote Privilege Escalation. This vulnerability is reported as CVE-2026-45404. The attack can be launched remotely. No exploit exists.

Detailsinfo

A vulnerability, which was classified as critical, was found in OpenTelemetry up to 1.44.x. Affected is an unknown function. The manipulation with an unknown input leads to a remote privilege escalation vulnerability. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 0.11.0 through 1.44.0, the OpenTracing bridge's bridgeSpan contains an unsynchronized extraBaggageItems map which can cause a panic. Because Go maps are not safe for concurrent read/write access, concurrent SetBaggageItem and correlation.MapFromContext calls on the same hooked bridgeSpan can trigger a fatal runtime error—such as concurrent map read and map write or concurrent map iteration and map write—terminating the process and causing denial of service. This issue is fixed in version 1.45.0.

The advisory is available at github.com. This vulnerability is traded as CVE-2026-45404 since 05/12/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The technical details are unknown and an exploit is not available.

Upgrading to version 1.45.0 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Name

• OpenTelemetry

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.11
• 1.12
• 1.13
• 1.14
• 1.15
• 1.16
• 1.17
• 1.18
• 1.19
• 1.20
• 1.21
• 1.22
• 1.23
• 1.24
• 1.25
• 1.26
• 1.27
• 1.28
• 1.29
• 1.30
• 1.31
• 1.32
• 1.33
• 1.34
• 1.35
• 1.36
• 1.37
• 1.38
• 1.39
• 1.40
• 1.41
• 1.42
• 1.43
• 1.44

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion