6.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-48496

CVE-2026-48496: opentelemetry-ebpf-profiler: Unprivileged process can trigger a denial of service on the ebpf-profiler agent

Summary

An unprivileged process can easily trigger the processPIDEvents goroutine to be blocked indefinitely, preventing the goroutine from analyzing any new ELF file. The goroutine stays blocked in the openat2 syscall forever and the profiler can no longer work properly, it is a denial of service.

Impact

The impact is limited to denial-of-service on the ebpf-profiler agent:

There has to be a malicious workload albeit unprivileged.
No exfiltration of data. No loss of data.

Fix

Fixed in https://github.com/open-telemetry/opentelemetry-ebpf-profiler/commit/234b685cab31c2cb2f79e966caeab168bcc489e4.

Fix is part of v.0.0.202622.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-48496

CVE-2026-48496:

6.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
go.opentelemetry.io/ebpf-profiler	go	>= 0.0.202527, < 0.0.202622	0.0.202622

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a denial-of-service in the opentelemetry-ebpf-profiler agent. The root cause is the agent's handling of file openings when profiling processes. The agent needs to read ELF files and other process-related files. An unprivileged malicious process can create a named pipe (FIFO) at a location where the profiler agent expects to find a regular file. When the agent attempts to open this FIFO using standard functions like os.Open or unix.Stat, the operation blocks indefinitely because the malicious process never writes to the pipe. This blocks the agent's goroutine, preventing it from profiling any further processes.

The patch addresses this by replacing the blocking file-opening mechanisms with the openat2 syscall, which is available in Linux kernels 5.6 and later. The fix introduces a new openInRoot function that uses openat2 with specific flags (O_PATH, RESOLVE_IN_ROOT, RESOLVE_NO_MAGICLINKS) to open a file path without blocking on special files like FIFOs. It then uses fstat to verify that the opened file is a regular, non-empty file before proceeding. The functions responsible for file access (OpenMappingFile, GetMappingFileLastModified, CalculateMappingFileID, OpenELF) were all modified to use this new, safer file-opening logic, thus preventing the denial-of-service.

Vulnerable functions

systemProcess.OpenMappingFile

process/process.go

This function was responsible for opening the backing file of a memory mapping. It used `os.Open` on a path constructed from the mapping information. An attacker could create a FIFO at this path, causing `os.Open` to block indefinitely, leading to a denial of service. The patch replaces this with a call to a modified `getMappingFile` function which uses a non-blocking open mechanism.

systemProcess.GetMappingFileLastModified

process/process.go

This function retrieved the last modified time of a mapping's backing file. It used `unix.Stat` on the file path. If the path pointed to a FIFO, `unix.Stat` would block, causing a denial of service. The patch changes this to use `fstat` on an already opened, safe file descriptor.

systemProcess.CalculateMappingFileID

process/process.go

This function calculated a file ID from the executable file of a mapping. It called a helper function that would open the file path. If the path was a FIFO, the open operation would block. The patch modifies this to use a reader from an already opened, safe file descriptor.

systemProcess.OpenELF

process/process.go

This function opened an ELF file, either from a mapping or from a path within the process's root filesystem. It used `pfelf.Open`, which internally calls `os.Open`. This could block if the path was a FIFO. The patch replaces this with `pfelf.OpenFile` using a safe file descriptor obtained via the new `openInProcRoot` or `getMappingFile` functions, which prevent blocking on special files.

pfelf.Open

libpf/pfelf/file.go

This function opens an ELF file from a given path using `os.Open`. If the path points to a FIFO or other special file that blocks on open, this function will block indefinitely. The vulnerable callers in the `process` package were modified to no longer use this function for potentially malicious paths.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.