CVE-2026-81192High· 7.0▾ Twilight`OpenTelemetry.Resources.Host` NuGet package, which provides OpenTelemetry resource detectors for host, is affected by an untrusted search path vulnerability on macOS. Prior to version 1.16.0-beta.2, the `host.id` resource attribute dete…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 38.5 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 9.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.1%
Last analysed / modified upstream
OpenTelemetry.Resources.Host NuGet package, which provides OpenTelemetry resource detectors for host, is affected by an untrusted search path vulnerability on macOS. Prior to version 1.16.0-beta.2, the host.id resource attribute detector launches the sh and ioreg executables by bare name rather than by absolute path, so both are resolved through the PATH environment variable. A local attacker who is less privileged than the host application, and who can influence PATH or write to a directory that appears in PATH ahead of the system directories, can have an arbitrary binary executed in the application's security context, resulting in local code execution/privilege escalation. This vulnerability only affect macOS hosts - Linux and Windows hosts are unaffected. Version 1.16.0-beta.2 contains a patch. No known workarounds are available.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
OpenTelemetry.Resources.Host < 1.16.0-beta.2Patched in:
OpenTelemetry.Resources.Host 1.16.0-beta.2Connected by shared product, vendor, weakness, or advisory.
CVE-2026-81872Medium· 6.3OpenTelemetry-Go is the Go implementation of OpenTelemetry
CVE-2026-81869Medium· 5.1OpenTelemetry-Go is the Go implementation of OpenTelemetry
CVE-2026-81871Medium· 6.3OpenTelemetry-Go is the Go implementation of OpenTelemetry
CVE-2026-81870Low· 2.0OpenTelemetry-Go is the Go implementation of OpenTelemetry
CVE-2026-47701High· 7.7The OpenTelemetry Operator is a Kubernetes Operator for the OpenTelemetry Collector
CVE-2026-45292Medium· 5.3opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing telemetry recorded by the API