CVE-2026-45678: OpenTelemetry eBPF Instrumentation: Postgres BIND parsing can panic on malformed payloads

Synopsis

An uncontrolled panic vulnerability exists in the Postgres protocol parser of OpenTelemetry eBPF Instrumentation (OBI) versions prior to 0.9.0. The parser incorrectly assumes every BIND message payload contains a valid NUL-terminated portal name; a crafted empty or unterminated payload causes OBI to read past the end of the captured buffer and panic. The vulnerability is reachable over the network with no authentication required, and successful exploitation crashes the instrumentation process, disrupting observability coverage. HarborGuard is tracking this advisory and will make a patched-image rebuild available as soon as an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The Postgres parser is exposed over the network, so an attacker must be able to send crafted BIND messages to the instrumented service's network endpoint.

• AuthenticationNot required

  No credentials or prior authentication are needed to send a malformed BIND message payload to the affected parser.

• Victim interactionNot required

  Exploitation is fully attacker-driven and requires no action from any user or operator of the affected system.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions, special memory layouts, or environmental prerequisites are required.

Blast Radius

• The OBI instrumentation process panics and terminates, dropping all eBPF-based observability and tracing coverage for the host.
• Any downstream alerting, distributed tracing pipelines, or SLO monitors that depend on OBI data lose their input source until the process is restarted.
• An attacker can trigger this crash repeatedly, turning a single crafted packet into a sustained denial of observability for the affected host.