CVE-2026-39883: OpenTelemetry-Go Path Traversal Vulnerability

CVE-2026-39883 Overview

CVE-2026-39883 is a PATH hijacking vulnerability affecting OpenTelemetry-Go, the Go implementation of OpenTelemetry. The vulnerability exists in versions 1.15.0 through 1.42.0, where an incomplete fix for the previous CVE-2026-24051 left the BSD kenv command using a bare name instead of an absolute path. This oversight allows attackers to perform PATH hijacking attacks on BSD and Solaris platforms, potentially leading to arbitrary code execution with the privileges of the affected application.

Critical Impact

Local attackers can hijack the kenv command execution path to execute malicious code with elevated privileges on BSD and Solaris systems running vulnerable OpenTelemetry-Go versions.

Affected Products

• OpenTelemetry-Go versions 1.15.0 through 1.42.0
• BSD-based systems utilizing OpenTelemetry-Go
• Solaris systems utilizing OpenTelemetry-Go

Discovery Timeline

• 2026-04-08 - CVE-2026-39883 published to NVD
• 2026-04-09 - Last updated in NVD database

Technical Details for CVE-2026-39883

Vulnerability Analysis

This vulnerability represents an Untrusted Search Path issue (CWE-426) that stems from an incomplete security fix. When the previous vulnerability CVE-2026-24051 was addressed, the Darwin ioreg command was correctly modified to use an absolute path. However, the BSD kenv command was inadvertently left using a bare command name without specifying the full path.

The local attack vector requires an attacker to have local access to the system, though exploitation itself does not require user interaction once the malicious binary is positioned in the PATH. Successful exploitation can result in complete compromise of confidentiality, integrity, and availability of the affected system, as the attacker-controlled code executes with the same privileges as the OpenTelemetry-Go application.

Root Cause

The root cause is an incomplete patch for CVE-2026-24051. While the fix addressed the PATH hijacking issue for Darwin systems by using an absolute path for the ioreg command, it failed to apply the same mitigation for the kenv command used on BSD and Solaris platforms. This inconsistency left a security gap where attackers could place a malicious binary named kenv earlier in the system's PATH, causing the vulnerable OpenTelemetry-Go code to execute the attacker's binary instead of the legitimate system command.

Attack Vector

The attack requires local access to the target system running a vulnerable version of OpenTelemetry-Go on BSD or Solaris. The attacker must be able to modify the PATH environment variable or place a malicious executable named kenv in a directory that appears earlier in the PATH than the legitimate kenv binary location.

The exploitation flow involves placing a malicious kenv binary in a directory within the system PATH, then triggering the vulnerable OpenTelemetry-Go functionality that calls the kenv command. When OpenTelemetry-Go attempts to execute kenv without an absolute path, the system searches the PATH directories in order, potentially finding and executing the attacker's malicious binary first. This results in arbitrary code execution with the privileges of the OpenTelemetry-Go application.

Detection Methods for CVE-2026-39883

Indicators of Compromise

• Presence of unexpected kenv binaries in non-standard PATH directories such as /tmp, /var/tmp, or user-writable locations
• Unusual process execution chains where kenv is spawned from unexpected parent processes
• Modified PATH environment variables in service configurations or startup scripts
• Suspicious file creation events in directories commonly used for PATH hijacking attacks

Detection Strategies

• Monitor for file creation events that create executables named kenv outside of standard system directories
• Implement file integrity monitoring on system directories to detect unauthorized binary modifications
• Audit PATH environment variable configurations in system services and applications using OpenTelemetry-Go
• Review process execution logs for anomalous kenv command invocations

Monitoring Recommendations

• Enable comprehensive logging of command execution on BSD and Solaris systems
• Configure alerting for any new executable files created with names matching common system commands
• Monitor OpenTelemetry-Go application logs for unexpected behavior or errors during initialization
• Implement endpoint detection and response (EDR) solutions to identify PATH manipulation attempts

How to Mitigate CVE-2026-39883

Immediate Actions Required

• Upgrade OpenTelemetry-Go to version 1.43.0 or later immediately
• Audit all systems running OpenTelemetry-Go versions 1.15.0 through 1.42.0 on BSD and Solaris platforms
• Review PATH configurations for affected services and ensure system directories have priority
• Implement file system monitoring on directories commonly targeted for PATH hijacking

Patch Information

OpenTelemetry has released version 1.43.0 which addresses this vulnerability by using absolute paths for the kenv command on BSD and Solaris platforms. Organizations should upgrade to this version or later to remediate CVE-2026-39883. For detailed information about the fix, refer to the GitHub Release v1.43.0 and the GitHub Security Advisory GHSA-hfvc-g4fc-pqhx.

Workarounds

• Restrict write access to directories in the system PATH to prevent unauthorized binary placement
• Configure services running OpenTelemetry-Go to use a minimal, hardened PATH that includes only necessary system directories
• Implement mandatory access control policies (SELinux, AppArmor equivalents for BSD) to restrict command execution
• Remove unnecessary directories from the PATH environment variable for services using OpenTelemetry-Go

# Configuration example for hardening PATH in service environment
# Ensure kenv is called from its absolute path location
export PATH="/sbin:/usr/sbin:/bin:/usr/bin"

# Verify kenv location on BSD systems
which kenv
# Should return: /sbin/kenv or /usr/sbin/kenv

# Check for suspicious kenv binaries in common attack directories
find /tmp /var/tmp /home -name "kenv" -type f 2>/dev/null