OpenTelemetry.Exporter.OpenTelemetryProtocol enables a disk‑retry mechanism that, when misconfigured, writes telemetry data to a subdirectory under the system temporary folder. If the experimental retry directory is not explicitly set, the exporter defaults to the shared temp path returned by Path.GetTempPath(). On systems where the temp folder is world‑writeable, an attacker can deposit crafted *.blob files, read blobs produced by the application, or fill the directory with oversized files, leading to information disclosure and denial‑of‑service due to disk space exhaustion. The weakness is a cache‑path selection flaw listed as CWE‑379.

This defect affects the OpenTelemetry .NET OTLP exporter library delivered as the open-telemetry:opentelemetry-dotnet package. Versions from 1.8.0 through 1.15.2 are vulnerable. The issue was resolved in version 1.15.3, which correctly honours the OTEL_DOTNET_EXPERIMENTAL_OTLP_DISK_RETRY_DIRECTORY_PATH setting and avoids using the generic temp path when it is not supplied.

The CVSS score of 6.5 indicates moderate severity, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a local user with write access to the system temp directory and awareness of the OTLP exporter’s behaviour, making it an environment‑dependent attack. In multi‑user deployments where the temporary folder is shared and unsecured, an attacker could inject blob files that are later read by the exporter, potentially allowing the read of another user’s export data or causing a denial of service by exhausting disk space. Because EPSS is not available, the likelihood of exploitation remains uncertain but could be significant in environments with misconfigured temp‑directory permissions.