OpenTelemetry OpenTelemetry.Resources.Host up to 1.16.0-beta.1 Host ID Detector untrusted search path

Summaryinfo

A vulnerability was found in OpenTelemetry OpenTelemetry.Resources.Host up to 1.16.0-beta.1. It has been classified as critical. The affected element is an unknown function of the component Host ID Detector. This manipulation causes untrusted search path. This vulnerability is registered as CVE-2026-81192. The attack needs to be launched locally. No exploit is available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in OpenTelemetry OpenTelemetry.Resources.Host up to 1.16.0-beta.1. It has been declared as critical. Affected by this vulnerability is an unknown code block of the component Host ID Detector. The manipulation with an unknown input leads to a untrusted search path vulnerability. The CWE definition for the vulnerability is CWE-426. The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

`OpenTelemetry.Resources.Host` NuGet package, which provides OpenTelemetry resource detectors for host, is affected by an untrusted search path vulnerability on macOS. Prior to version 1.16.0-beta.2, the `host.id` resource attribute detector launches the `sh` and `ioreg` executables by bare name rather than by absolute path, so both are resolved through the `PATH` environment variable. A local attacker who is less privileged than the host application, and who can influence `PATH` or write to a directory that appears in `PATH` ahead of the system directories, can have an arbitrary binary executed in the application's security context, resulting in local code execution/privilege escalation. This vulnerability only affect macOS hosts - Linux and Windows hosts are unaffected. Version 1.16.0-beta.2 contains a patch. No known workarounds are available.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-81192 since 08/26/2026. The exploitation appears to be difficult. Attacking locally is a requirement. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1574 according to MITRE ATT&CK.

Upgrading to version 1.16.0-beta.2 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• OpenTelemetry

Name

• OpenTelemetry.Resources.Host

Version

• 1.16.0-beta.0
• 1.16.0-beta.1

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion