OpenTelemetry eBPF Instrumentation exposes a flaw in the Java agent injection path that lets a local attacker who controls a Java workload overwrite arbitrary files on the host when the injection feature is enabled. The vulnerability arises because the injector trusts the temporary directory of the target process and creates files with unsafe semantics, permitting both filesystem boundary escape and symlink-based clobbering. The flaw is classified as CWE-22 and CWE-59 and can compromise confidentiality, integrity, and availability of critical host files.

The affected product is OpenTelemetry eBPF Instrumentation from the open-telemetry vendor, specifically versions 0.4.0 through any release before 0.8.0. Deployments that run Java injection with elevated privileges are susceptible.

The EPSS score of less than 1 % indicates that exploitation is expected to be rare, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires local access to a Java process, the ability to trigger the Java agent injection, and that the instrumentation runs with elevated privileges. Under these conditions, an attacker could overwrite arbitrary host files, potentially compromising the entire system.