CVE-2026-81192: OpenTelemetry Host NuGet Privilege Escalation

CVE-2026-81192 Overview

The OpenTelemetry.Resources.Host NuGet package contains an untrusted search path vulnerability that affects macOS hosts. The host.id resource attribute detector invokes the sh and ioreg executables by bare name instead of absolute path. Both binaries resolve through the PATH environment variable at runtime. A local attacker with lower privileges than the host application can influence PATH or place a malicious binary in a directory that appears before system directories. This results in arbitrary code execution in the application's security context and enables local privilege escalation. Linux and Windows hosts are unaffected. Version 1.16.0-beta.2 contains the patch.

Critical Impact
Local attackers on macOS can achieve code execution in the OpenTelemetry host application's security context, enabling privilege escalation.

Affected Products

OpenTelemetry.Resources.Host NuGet package versions prior to 1.16.0-beta.2
.NET applications running on macOS that use the OpenTelemetry host resource detector
Deployments where lower-privileged local users can modify PATH or write to directories in it

Discovery Timeline

2026-09-08 - CVE-2026-81192 published to the National Vulnerability Database (NVD)
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-81192

Vulnerability Analysis

The vulnerability is classified as an untrusted search path issue [CWE-426]. The host.id resource attribute detector in OpenTelemetry.Resources.Host executes sh and ioreg to gather host identity information on macOS. Both binaries are launched by bare name rather than absolute path. The operating system therefore resolves them via the PATH environment variable inherited by the process.

When a directory writable by a lower-privileged user precedes /bin or /usr/sbin in PATH, the loader executes an attacker-supplied binary instead of the legitimate system utility. The malicious binary runs with the privileges of the OpenTelemetry-instrumented application. This turns a benign telemetry initialization step into a local code execution primitive.

Root Cause

The root cause is unsafe process launch semantics inside the host resource detector. The detector relies on PATH lookup instead of hard-coding absolute paths such as /bin/sh and /usr/sbin/ioreg. macOS process spawning APIs honor PATH for bare executable names, so any process that can influence the environment or filesystem search order can hijack execution.

Attack Vector

Exploitation requires local access and low privileges on the macOS host. The attacker must either write to a directory that already appears in PATH ahead of the system directories, or influence the PATH used by the target application. The attacker then places an executable named sh or ioreg in that directory. When the instrumented application initializes host resource detection, the malicious binary executes in the application's security context.

Because the trigger is standard OpenTelemetry initialization, exploitation does not require the attacker to interact with the application after planting the binary. Refer to the GitHub Security Advisory GHSA-v8pv-4842-x354 for maintainer analysis.

Detection Methods for CVE-2026-81192

Indicators of Compromise

Presence of executable files named sh or ioreg in non-standard directories that appear in the process PATH
Unexpected child processes of .NET applications on macOS that do not resolve to /bin/sh or /usr/sbin/ioreg
Modifications to user-level shell initialization files that prepend writable directories to PATH

Detection Strategies

Audit macOS endpoints for OpenTelemetry.Resources.Host package versions earlier than 1.16.0-beta.2 using software inventory data
Monitor process execution telemetry for sh or ioreg invocations whose resolved binary path is outside standard system directories
Flag environment variable manipulations that add world-writable or user-writable directories to PATH before /bin and /usr/sbin

Monitoring Recommendations

Correlate process start events with parent .NET runtime processes to identify anomalous resource detector executions
Alert on file creation events for executables named sh or ioreg outside of package-managed locations
Track privilege boundaries between the writing user and the executing application to detect cross-privilege binary planting

How to Mitigate CVE-2026-81192

Immediate Actions Required

Upgrade OpenTelemetry.Resources.Host to version 1.16.0-beta.2 or later on all macOS deployments
Inventory macOS hosts running .NET applications that reference the OpenTelemetry host resource detector
Review PATH configuration for service accounts and application launch contexts to ensure system directories precede any user-writable directories

Patch Information

The maintainers released the fix in OpenTelemetry.Resources.Host version 1.16.0-beta.2. The patch replaces bare-name invocations with absolute paths to sh and ioreg. Details are available in GitHub Pull Request #1631 and GitHub Pull Request #4760.

Workarounds

No official workarounds are available according to the vendor advisory
Restrict local access to macOS hosts running vulnerable versions until the patched package is deployed
Enforce strict file permissions on any directory listed in PATH to prevent lower-privileged users from planting binaries

bash

# Configuration example: verify installed package version and inspect PATH
dotnet list package --include-transitive | grep -i OpenTelemetry.Resources.Host
echo "$PATH" | tr ':' '\n'