CVE-2026-39883OpenTelemetry-Go has an incomplete fix for CVE-2026-24051: BSD kenv command not using absolute path enables PATH hijacking
Updated under an hour ago ()
Does this affect you?
It affects open-telemetry opentelemetry-go and 6 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
OpenTelemetry-Go is the Go implementation of OpenTelemetry. From 1.15.0 to 1.42.0, the fix for CVE-2026-24051 changed the Darwin ioreg command to use an absolute path but left the BSD kenv command using a bare name, allowing the same PATH hijacking attack on BSD and Solaris platforms. This vulnerability is fixed in 1.43.0.
- CVSS
- 7.3 HIGH (v4.0, CNA)CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- Weakness (CWE)
- CWE-426
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- GitHub_M
- NVD analysis
- Modified
- Record last updated
- Sep 9, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
open-telemetry opentelemetry-go open_telemetry:opentelemetry_go (from the name) | from 1.15.0, < 1.43.0 | CNA record |
Red Hat Cert Manager support for Red Hat OpenShift release 1.19 redhat:cert_manager | from 1788348594 not affected | CISA ADP |
Red Hat multicluster engine for Kubernetes 2.8 redhat:multicluster_engine | from 1781539691 not affected | CISA ADP |
Red Hat Red Hat Openshift Data Foundation 4.22 redhat:openshift_data_foundation | from 1782932114 not affected | CISA ADP |
Red Hat Red Hat OpenShift Workload Availability 0.3 redhat:workload_availability_sbr | from 1785203474 not affected | CISA ADP |
Red Hat Red Hat OpenShift Workload Availability 0.8 redhat:workload_availability_far | from 1785203079 not affected | CISA ADP |
opentelemetry opentelemetry opentelemetry:opentelemetry | from 1.15.0 before 1.43.0 | NVD |
References
- https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-hfvc-g4fc-pqhxx-refsource-confirm, exploit, third-party-advisory
- http://github.com/open-telemetry/opentelemetry-go/releases/tag/v1.43.0x-refsource-misc, release-notes
- https://access.redhat.com/errata/RHSA-2026:26254
- https://access.redhat.com/errata/RHSA-2026:26257
- https://access.redhat.com/errata/RHSA-2026:37387
- https://access.redhat.com/errata/RHSA-2026:54274
- https://access.redhat.com/errata/RHSA-2026:54286
- https://access.redhat.com/errata/RHSA-2026:63140
- https://access.redhat.com/security/cve/CVE-2026-39883
- https://bugzilla.redhat.com/show_bug.cgi?id=2456718
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39883.json
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.