Skip to content

OpenTelemetry-Go: Unsynchronized baggage map can panic under concurrent access

Moderate severity GitHub Reviewed Published Aug 20, 2026 in open-telemetry/opentelemetry-go • Updated Aug 20, 2026

Package

gomod go.opentelemetry.io/otel/bridge/opentracing (Go)

Affected versions

>= 0.11.0, < 1.45.0

Patched versions

1.45.0

Description

Summary

go.opentelemetry.io/otel/bridge/opentracing introduced an unsynchronized extraBaggageItems map on bridgeSpan. One goroutine can write this map through Span.SetBaggageItem while another goroutine reads and iterates it during correlation baggage propagation, which can trigger Go's fatal concurrent map access panic and crash the process. The finding is low severity because exploitation requires a specific OpenTracing bridge configuration and concurrent use of the same span.

Introduced in commit: 8cddf30

Details

bridge/opentracing/bridge.go:80-85 adds extraBaggageItems map[string]string to bridgeSpan without a mutex or other synchronization primitive. bridge/opentracing/bridge.go:219-234 shows SetBaggageItem calling updateOtelContext, which lazily creates the map and writes s.extraBaggageItems[restrictedKey] = value without locking. bridge/opentracing/bridge.go:359-377 shows correlationGetHook reading bSpan.extraBaggageItems, checking len(items), and iterating for k, v := range items without locking. The finding evidence also identifies api/correlation/context.go:160-165 as the path where correlation.MapFromContext invokes the get hook, allowing a read path to run concurrently with baggage writes.

Because Go maps are not safe for concurrent read/write access, concurrent SetBaggageItem and correlation.MapFromContext calls on the same hooked bridgeSpan can terminate the process with a runtime error such as fatal error: concurrent map read and map write or fatal error: concurrent map iteration and map write.

PoC

validation-artifact.zip

The validation artifact contains a PoC at validation-artifact.tar:validation_poc_concurrent_map.go and supporting notes at validation-artifact.tar:validation_poc_README.txt.

Use a checkout of pellared/opentelemetry-go at commit 8cddf30 with Go module downloads enabled. The local validation environment could not complete the run because GOPROXY=off blocked dependency resolution; that blocked output is saved in validation-artifact.tar:validation_poc_run.log.

Commands:

cd /path/to/opentelemetry-go
git checkout 8cddf30
tar -xOf /path/to/finding-directory/validation-artifact.tar validation_poc_concurrent_map.go > ./validation_poc_concurrent_map.go
GOPROXY=https://proxy.golang.org,direct go run ./validation_poc_concurrent_map.go

The PoC starts a BridgeTracer, creates a span, installs correlation hooks with tracer.NewHookedContext(ctx), initializes baggage once, then runs one goroutine repeatedly calling span.SetBaggageItem(...) while another repeatedly calls otelcorrelation.MapFromContext(ctx). A vulnerable build is expected to terminate with a Go runtime concurrent map access error, for example:

fatal error: concurrent map read and map write

or:

fatal error: concurrent map iteration and map write

Impact

This is a race condition / improper synchronization vulnerability in a shared Go map. Applications using the OpenTelemetry OpenTracing bridge with correlation hooks can crash if the same bridgeSpan is accessed concurrently, with one execution path setting baggage and another propagating correlation baggage. The practical impact is denial of service for the affected application process; exposure depends on whether application request handling or internal concurrency can trigger those operations on the same span.

References

@pellared pellared published to open-telemetry/opentelemetry-go Aug 20, 2026
Published to the GitHub Advisory Database Aug 20, 2026
Reviewed Aug 20, 2026
Last updated Aug 20, 2026

Severity

Moderate

CVSS overall score

This score calculates overall vulnerability severity from 0 to 10 and is based on the Common Vulnerability Scoring System (CVSS).
/ 10

CVSS v4 base metrics

Exploitability Metrics
Attack Vector Local
Attack Complexity Low
Attack Requirements Present
Privileges Required None
User interaction None
Vulnerable System Impact Metrics
Confidentiality None
Integrity None
Availability High
Subsequent System Impact Metrics
Confidentiality None
Integrity None
Availability None

CVSS v4 base metrics

Exploitability Metrics
Attack Vector: This metric reflects the context by which vulnerability exploitation is possible. This metric value (and consequently the resulting severity) will be larger the more remote (logically, and physically) an attacker can be in order to exploit the vulnerable system. The assumption is that the number of potential attackers for a vulnerability that could be exploited from across a network is larger than the number of potential attackers that could exploit a vulnerability requiring physical access to a device, and therefore warrants a greater severity.
Attack Complexity: This metric captures measurable actions that must be taken by the attacker to actively evade or circumvent existing built-in security-enhancing conditions in order to obtain a working exploit. These are conditions whose primary purpose is to increase security and/or increase exploit engineering complexity. A vulnerability exploitable without a target-specific variable has a lower complexity than a vulnerability that would require non-trivial customization. This metric is meant to capture security mechanisms utilized by the vulnerable system.
Attack Requirements: This metric captures the prerequisite deployment and execution conditions or variables of the vulnerable system that enable the attack. These differ from security-enhancing techniques/technologies (ref Attack Complexity) as the primary purpose of these conditions is not to explicitly mitigate attacks, but rather, emerge naturally as a consequence of the deployment and execution of the vulnerable system.
Privileges Required: This metric describes the level of privileges an attacker must possess prior to successfully exploiting the vulnerability. The method by which the attacker obtains privileged credentials prior to the attack (e.g., free trial accounts), is outside the scope of this metric. Generally, self-service provisioned accounts do not constitute a privilege requirement if the attacker can grant themselves privileges as part of the attack.
User interaction: This metric captures the requirement for a human user, other than the attacker, to participate in the successful compromise of the vulnerable system. This metric determines whether the vulnerability can be exploited solely at the will of the attacker, or whether a separate user (or user-initiated process) must participate in some manner.
Vulnerable System Impact Metrics
Confidentiality: This metric measures the impact to the confidentiality of the information managed by the VULNERABLE SYSTEM due to a successfully exploited vulnerability. Confidentiality refers to limiting information access and disclosure to only authorized users, as well as preventing access by, or disclosure to, unauthorized ones.
Integrity: This metric measures the impact to integrity of a successfully exploited vulnerability. Integrity refers to the trustworthiness and veracity of information. Integrity of the VULNERABLE SYSTEM is impacted when an attacker makes unauthorized modification of system data. Integrity is also impacted when a system user can repudiate critical actions taken in the context of the system (e.g. due to insufficient logging).
Availability: This metric measures the impact to the availability of the VULNERABLE SYSTEM resulting from a successfully exploited vulnerability. While the Confidentiality and Integrity impact metrics apply to the loss of confidentiality or integrity of data (e.g., information, files) used by the system, this metric refers to the loss of availability of the impacted system itself, such as a networked service (e.g., web, database, email). Since availability refers to the accessibility of information resources, attacks that consume network bandwidth, processor cycles, or disk space all impact the availability of a system.
Subsequent System Impact Metrics
Confidentiality: This metric measures the impact to the confidentiality of the information managed by the SUBSEQUENT SYSTEM due to a successfully exploited vulnerability. Confidentiality refers to limiting information access and disclosure to only authorized users, as well as preventing access by, or disclosure to, unauthorized ones.
Integrity: This metric measures the impact to integrity of a successfully exploited vulnerability. Integrity refers to the trustworthiness and veracity of information. Integrity of the SUBSEQUENT SYSTEM is impacted when an attacker makes unauthorized modification of system data. Integrity is also impacted when a system user can repudiate critical actions taken in the context of the system (e.g. due to insufficient logging).
Availability: This metric measures the impact to the availability of the SUBSEQUENT SYSTEM resulting from a successfully exploited vulnerability. While the Confidentiality and Integrity impact metrics apply to the loss of confidentiality or integrity of data (e.g., information, files) used by the system, this metric refers to the loss of availability of the impacted system itself, such as a networked service (e.g., web, database, email). Since availability refers to the accessibility of information resources, attacks that consume network bandwidth, processor cycles, or disk space all impact the availability of a system.
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

EPSS score

Exploit Prediction Scoring System (EPSS)

This score estimates the probability of this vulnerability being exploited within the next 30 days. Data provided by FIRST.
(3rd percentile)

Weaknesses

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently. Learn more on MITRE.

Improper Locking

The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors. Learn more on MITRE.

CVE ID

CVE-2026-45404

GHSA ID

GHSA-42cj-99w8-cp2p

Source code

Credits

Loading Checking history
See something to contribute? Suggest improvements for this vulnerability.