Path Hijacking Vulnerability in OpenTelemetry-Go by OpenTelemetry
CVE-2026-39883

7.3HIGH

Key Information:

Vendor

Open-telemetry

Status
Opentelemetry-go
Vendor
CVE Published:
8 April 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-39883?

A vulnerability has been identified in OpenTelemetry-Go versions 1.15.0 to 1.42.0, where the BSD kenv command is susceptible to PATH hijacking. The fix for a related issue altered the Darwin ioreg command to utilize an absolute path, yet overlooked the BSD kenv command, which remains vulnerable. This flaw permits potential attackers to exploit environment variable manipulation on BSD and Solaris platforms. The vulnerability has been resolved in version 1.43.0, emphasizing the importance of updating to mitigate this security risk.

Affected Version(s)

opentelemetry-go >= 1.15.0, < 1.43.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

SSI-cve-39883-lab
Created by NinjaShadowBoy

References

https://github.com/open-telemetry/opentelemetry-go/securi...
x_refsource_CONFIRM
http://github.com/open-telemetry/opentelemetry-go/release...
x_refsource_MISC

CVSS V4

Score:
7.3
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.