CVE-2026-81192 Details
Description
`OpenTelemetry.Resources.Host` NuGet package, which provides OpenTelemetry resource detectors for host, is affected by an untrusted search path vulnerability on macOS. Prior to version 1.16.0-beta.2, the `host.id` resource attribute detector launches the `sh` and `ioreg` executables by bare name rather than by absolute path, so both are resolved through the `PATH` environment variable. A local attacker who is less privileged than the host application, and who can influence `PATH` or write to a directory that appears in `PATH` ahead of the system directories, can have an arbitrary binary executed in the application's security context, resulting in local code execution/privilege escalation. This vulnerability only affect macOS hosts - Linux and Windows hosts are unaffected. Version 1.16.0-beta.2 contains a patch. No known workarounds are available.
A vulnerability exists in the OpenTelemetry.Resources.Host NuGet package, specifically in versions prior to 1.16.0-beta.2. The issue arises from the host.id resource attribute detector, which executes the sh and ioreg commands using their bare names instead of absolute paths. This flaw creates an untrusted search path vulnerability on macOS, where a local attacker with limited privileges can manipulate the PATH environment variable or write to a directory that precedes system directories. By doing so, the attacker can execute arbitrary binaries in the context of the host application, leading to unauthorized code execution and potential privilege escalation. This vulnerability is exclusive to macOS; Linux and Windows are not affected.
Users can upgrade to OpenTelemetry.Resources.Host version 1.16.0-beta.2 or later to address this vulnerability. Instructions for updating can be found in the NuGet package manager.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 8, 2026CISA-ADP
Assessed Sep 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/1631 | [email protected] | Issue TrackingVendor |
| https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/4760 | [email protected] | Issue TrackingVendor |
| https://github.com/open-telemetry/opentelemetry-dotnet-contrib/security/advisories/GHSA-v8pv-4842-x354 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-426 | Untrusted Search Path | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| OpenTelemetry.Resources.Host | < 1.16.0-beta.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 9, 2026 | CVE Modified | CISA-ADP |
| Sep 8, 2026 | New CVE Received | [email protected] |