CVE-2026-42191

The record

OpenTelemetry.Exporter.OpenTelemetryProtocol is the OTLP (OpenTelemetry Protocol) exporter implementation. From 1.8.0 to 1.15.2, the OTLP disk retry feature in OpenTelemetry.Exporter.OpenTelemetryProtocol silently fell back to Path.GetTempPath() when OTEL_DOTNET_EXPERIMENTAL_OTLP_RETRY=disk was set but OTEL_DOTNET_EXPERIMENTAL_OTLP_DISK_RETRY_DIRECTORY_PATH was not configured. The exporter stored and loaded *.blob files under fixed, signal-named subdirectories (traces, metrics, logs) beneath that shared temporary root path. On multi-user systems where the temporary directory is accessible to other local accounts, this allows an attacker to write crafted *.blob files, read *.blob files written by the application between export failures, or deposit numerous or oversized blob files, degrading retry-loop performance or consuming disk space. This vulnerability is fixed in 1.15.3.

Affected packages

Related vulnerabilities

• CVE-2026-85028 Creation of a temporary file in a directory with insecure permissions in the FPGA… CWE-379
• CVE-2026-82346 A potential security vulnerability has been identified in the HP ImageDiags for versions… CWE-379
• CVE-2026-50544 NortheBridge/luminalshine is a Sunshine-compatible game stream host for Moonlight. CWE-379
• CVE-2026-46388 osquery is a SQL powered operating system instrumentation, monitoring, and analytics… CWE-379
• CVE-2026-7539 A potential security vulnerability has been identified in the HP Accessory WMI Provider… CWE-379
• CVE-2026-54328 Pi is a minimal terminal coding harness. CWE-379
• GHSA-jfgx-wxx8-mp94 Pi Agent: Predictable temporary extension install paths allow local privilege escalation… CWE-379
• CVE-2019-25677 WinRAR 5.61 contains a denial of service vulnerability that allows local attackers to… CWE-379