CVE-2026-45404: 
Chainguard vulnerability analysis and mitigation

CVE-2026-45404 is a race condition vulnerability in the OpenTelemetry Go OpenTracing bridge (go.opentelemetry.io/otel/bridge/opentracing) caused by an unsynchronized extraBaggageItems map on the bridgeSpan struct. Concurrent goroutines — one writing via Span.SetBaggageItem and another reading during correlation baggage propagation — can trigger Go's fatal concurrent map access panic, crashing the process. The vulnerability affects versions >= 0.11.0, < 1.45.0 of the package and was disclosed on August 20, 2026. It carries a CVSS v4 base score of 5.9 (Medium/Moderate) (GitHub Advisory, OTel Security Advisory).

The root cause is improper synchronization (CWE-362, CWE-667): the extraBaggageItems map[string]string field added to bridgeSpan in bridge/opentracing/bridge.go (lines 80–85) has no mutex or other synchronization primitive. The SetBaggageItem method (lines 219–234) lazily initializes and writes to this map without locking, while correlationGetHook (lines 359–377) reads and iterates the same map without locking. The concurrent access path is triggered when correlation.MapFromContext (in api/correlation/context.go:160-165) invokes the get hook concurrently with a baggage write, causing Go's runtime to terminate the process with errors such as fatal error: concurrent map read and map write or fatal error: concurrent map iteration and map write. Exploitation requires the application to use the OpenTracing bridge with correlation hooks enabled and to share a bridgeSpan across concurrent goroutines. A proof-of-concept (validation_poc_concurrent_map.go) is included in the advisory's validation artifact (GitHub Advisory, OTel Security Advisory).

Successful exploitation results in a denial of service: the affected Go process terminates immediately with a fatal runtime panic due to concurrent map access. There is no confidentiality or integrity impact — the vulnerability exclusively affects availability of the vulnerable system. The practical blast radius is limited to applications that use the OpenTelemetry OpenTracing bridge with correlation hooks and that concurrently operate on the same span, but in such configurations the entire process (and all requests it serves) is terminated (GitHub Advisory, OTel Security Advisory).

A proof-of-concept is publicly available as part of the advisory's validation artifact, demonstrating the crash via concurrent span.SetBaggageItem and otelcorrelation.MapFromContext calls on the same hooked bridgeSpan. There is no evidence of in-the-wild exploitation, no known threat actor attribution, and the CVE status remains "Reserved" as of the disclosure date. Exploitation is constrained by specific preconditions (OpenTracing bridge with correlation hooks, concurrent span access), limiting its practical exploitability. No EPSS score or CISA KEV catalog entry is currently associated with this CVE (GitHub Advisory, OTel Security Advisory).

1. Identify a vulnerable target: Locate a Go application using go.opentelemetry.io/otel/bridge/opentracing at version >= 0.11.0, < 1.45.0 with the OpenTracing bridge configured with correlation hooks (tracer.NewHookedContext(ctx)).
2. Confirm concurrent span access: Verify that the application's request handling or internal concurrency allows multiple goroutines to operate on the same bridgeSpan — one path calling span.SetBaggageItem(key, value) and another path invoking otelcorrelation.MapFromContext(ctx).
3. Trigger concurrent map access: Cause both operations to execute simultaneously on the same span. In a PoC, this is achieved by starting one goroutine in a tight loop calling span.SetBaggageItem(...) and another goroutine in a tight loop calling otelcorrelation.MapFromContext(ctx).
4. Observe process crash: The Go runtime detects the unsynchronized concurrent map access and terminates the process with a fatal error: fatal error: concurrent map read and map write or fatal error: concurrent map iteration and map write, achieving denial of service (GitHub Advisory, OTel Security Advisory).

• Logs/Process Output: Go runtime fatal error messages in application logs or stderr, specifically:
  • fatal error: concurrent map read and map write
  • fatal error: concurrent map iteration and map write
• Process: Unexpected abrupt termination of the Go application process (non-zero exit code due to runtime panic) with a goroutine stack trace referencing bridge/opentracing/bridge.go functions such as SetBaggageItem, updateOtelContext, or correlationGetHook.
• Stack Trace Artifacts: Crash dumps or panic output referencing go.opentelemetry.io/otel/bridge/opentracing and api/correlation/context.go in the goroutine stack (GitHub Advisory).

Upgrade go.opentelemetry.io/otel/bridge/opentracing to version 1.45.0 or later, which includes the fix that prevents panics when OpenTracing baggage is propagated concurrently with Span.SetBaggageItem (OTel Release v1.45.0, GitHub Advisory). No configuration-based workaround is documented; the only remediation is upgrading to the patched version. As an interim measure, applications can avoid sharing a single bridgeSpan across concurrent goroutines that both write baggage and propagate correlation context.

The advisory was published by OpenTelemetry maintainer pellared and analyzed by MrAlias on August 20, 2026, as part of the v1.45.0 release cycle. The GoVulnBot flagged the issue for inclusion in the Go vulnerability database (golang/vulndb#6258). No significant broader media coverage or notable community commentary beyond the official advisory and release notes has been identified (OTel Security Advisory, OTel Release v1.45.0).