7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-45685

CVE-2026-45685: OpenTelemetry eBPF Instrumentation: MongoDB parser panics on malformed wire messages

OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. From version 0.1.0 to before version 0.9.0, malformed MongoDB wire messages can trigger uncaught panics in the MongoDB TCP parser, allowing a remote unauthenticated attacker to crash the telemetry agent and cause a denial of service. The parser operates on raw attacker-controlled network payloads before the input is fully validated, so a single crafted message can terminate telemetry collection for the affected process or node. This issue has been patched in version 0.9.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-45685

CVE-2026-45685:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable YesTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
go.opentelemetry.io/obi	go	< 0.9.0	0.9.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the MongoDB protocol parser of the OpenTelemetry eBPF instrumentation agent. The parser fails to properly validate the structure and length of incoming MongoDB wire messages before processing them. This allows a remote, unauthenticated attacker to send a specially crafted message that triggers an uncaught panic, leading to a process crash and a denial of service.

Three distinct vulnerable functions were identified:

parseOpMessage: This function was susceptible to a slice-out-of-bounds panic because it did not validate the buffer length before reading message flag bits. The fix involves adding a length check at the beginning of the function.
parseSections: Similarly, this function could panic with a slice-out-of-bounds error when parsing document sequences, as it didn't re-validate the buffer length before reading the sequence size. The fix adds the necessary length check.
parseFirstField: This function contained a fragile type assertion, assuming a BSON field's value was always a string. A malformed BSON document with a different type would cause a runtime panic. The fix for this, not present in the analyzed commit but in a later version, would involve safely checking the type before asserting it.

An attacker exploiting any of these flaws can terminate the telemetry agent, causing a loss of observability until the agent is manually restarted.

Vulnerable functions

parseOpMessage

pkg/ebpf/common/mongo_detect_transform.go

The function was vulnerable to a slice-bounds panic. It read OP_MSG flag bits from a buffer without first ensuring the buffer was large enough. A truncated OP_MSG packet sent by an attacker could trigger this panic and crash the process, causing a denial of service. The patch added a length check to prevent this.

parseSections

pkg/ebpf/common/mongo_detect_transform.go

The function was vulnerable to a slice-bounds panic when parsing document-sequence sections. It would read the sequence length from the buffer without re-validating that enough bytes were available. A malformed section could cause a panic, leading to a denial of service. The patch added a length check before reading the section length.

parseFirstField

pkg/ebpf/common/mongo_detect_transform.go

The function was vulnerable to a runtime panic caused by an incorrect type assertion. It assumed a specific BSON field value was always a string and did not handle cases where it was not. An attacker could send a malformed BSON document with a different type for this field, causing an `interface conversion` panic and crashing the agent.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.