CVE-2026-39883: OpenTelemetry-Go has an incomplete fix for CVE-2026-24051: BSD kenv command not using absolute path enables PATH hijacking
Summary
The fix for GHSA-9h8m-3fm2-qjrq (CVE-2026-24051) changed the Darwin ioreg command to use an absolute path but left the BSD kenv command using a bare name, allowing the same PATH hijacking attack on BSD and Solaris platforms.
Root Cause
sdk/resource/hostid.go line 42:
if result, err := r.execCommand("kenv", "-q", "smbios.system.uuid"); err == nil {
Compare with the fixed Darwin path at line 58:
result, err := r.execCommand("/usr/sbin/ioreg", "-rd1", "-c", "IOPlatformExpertDevice")
The execCommand helper at sdk/resource/hostidexec.go uses exec.Command(name, arg...) which searches $PATH when the command name contains no path separator.
Affected platforms (per build tag in hostidbsd.go:4): DragonFly BSD, FreeBSD, NetBSD, OpenBSD, Solaris.
The kenv path is reached when /etc/hostid does not exist (line 38-40), which is common on FreeBSD systems.
Attack
1. Attacker has local access to a system running a Go application that imports go.opentelemetry.io/otel/sdk 2. Attacker places a malicious kenv binary earlier in $PATH 3. Application initializes OpenTelemetry resource detection at startup 4. hostIDReaderBSD.read() calls exec.Command("kenv", ...) which resolves to the malicious binary 5. Arbitrary code executes in the context of the application
Same attack vector and impact as CVE-2026-24051.
Suggested Fix
Use the absolute path:
if result, err := r.execCommand("/bin/kenv", "-q", "smbios.system.uuid"); err == nil {
On FreeBSD, kenv is located at /bin/kenv.
Other sources
OpenTelemetry-Go is the Go implementation of OpenTelemetry. From 1.15.0 to 1.42.0, the fix for CVE-2026-24051 changed the Darwin ioreg command to use an absolute path but left the BSD kenv command using a bare name, allowing the same PATH hijacking attack on BSD and Solaris platforms. This vulnerability is fixed in 1.43.0.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/go.opentelemetry.io/otel/sdkto a version that resolves this vulnerability.Fixed in 1.43.0 - Upgrade
Upgrade
go.opentelemetry.io/otel/sdkto a version that resolves this vulnerability.Fixed in 1.43.0Patch GHSA-9h8m-3fm2-qjrq - Configuration
Update the BSD host ID reader to call exec.Command("/bin/kenv", "-q", "smbios.system.uuid") when /etc/hostid is not present. The material indicates that the vulnerable code uses exec.Command("kenv", ...) which searches $PATH; the fix uses the absolute path in sdk/resource/host_id.go line 42 (/bin/kenv on FreeBSD).
OpenTelemetry-Go (sdk/resource/host_id.go / host_id_exec.go) exec.Command invocation path for BSD host id detection (kenv) = Use absolute path "/bin/kenv" instead of bare "kenv" - Compensating control
On systems where OpenTelemetry-Go runs and PATH is user-influenceable, prevent PATH hijacking by ensuring untrusted users cannot place or control a malicious "kenv" earlier in $PATH (the attack described places a malicious kenv binary earlier in $PATH).