CVE-2026-45685: OpenTelemetry eBPF Instrumentation: MongoDB parser panics on malformed wire messages

Synopsis

This is a denial-of-service vulnerability in the OpenTelemetry eBPF Instrumentation MongoDB TCP parser, affecting versions 0.1.0 through 0.8.x. A remote, unauthenticated attacker can send a single crafted MongoDB wire message over the network, triggering an uncaught panic that crashes the telemetry agent. Successful exploitation terminates telemetry collection for the affected process or node. A patched-image rebuild at version 0.9.0 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the telemetry agent's MongoDB TCP parser over the network; any service exposed on a routable network interface is in scope.

• AuthenticationNot required

  No credentials or session token are needed; the parser processes raw wire messages before any authentication check occurs.

• Victim interactionNot required

  No user action is required; the attacker sends the crafted message directly to the listening agent.

• Attack complexityDetail

  Exploitation is reliable and condition-free; no race conditions or special environmental factors are required to trigger the panic.

Blast Radius

• Crashes the OpenTelemetry eBPF telemetry agent process, ending all telemetry collection for the node it runs on.
• Blinds observability pipelines that depend on this agent, eliminating traces, metrics, and logs from the affected host until the process is restarted.
• Confidentiality and data integrity of stored records are not affected; this is a pure availability impact.