CVE-2026-39883
Vulnerability Summary
Timeline
Description
OpenTelemetry-Go is the Go implementation of OpenTelemetry. From 1.15.0 to 1.42.0, the fix for CVE-2026-24051 changed the Darwin ioreg command to use an absolute path but left the BSD kenv command using a bare name, allowing the same PATH hijacking attack on BSD and Solaris platforms. This vulnerability is fixed in 1.43.0.
CVSS Metrics
- v4.0•HIGH•Score: 7.3CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- v4.0•HIGH•Score: 7.3CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- v3.1•HIGH•Score: 7CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Trends
Current EPSS score: 0.26%• Percentile: 18%
Techniques & Countermeasures
- CWE-426•Untrusted Search Path
The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.
Affected Systems
- chainguard•aactl
< 0.4.12-r56
- chainguard•addon-resizer
< 1.8.23-r22
- chainguard•addon-resizer-fips
< 1.8.23-r22
- chainguard•agentbeat
< 9.2.7-r4
- chainguard•agentbeat-fips
< 9.2.7-r5
- chainguard•amazon-cloudwatch-agent
< 1.300066.1-r1
- chainguard•amazon-cloudwatch-agent-fips
< 1.300066.1-r1
- chainguard•amazon-eks-ami
< 20260610-r1
- chainguard•amazon-eks-ami-fips
< 20260610-r1
- chainguard•ansible-operator
< 1.42.2-r8
- chainguard•ansible-operator-fips
< 1.42.2-r7
- chainguard•apisix-ingress-controller
< 2.0.1-r10
- chainguard•apm-server-8.17
< 8.17.10-r11
- chainguard•apm-server-8.18
all
- chainguard•apm-server-8.19
< 8.19.14-r1
- chainguard•apm-server-9.0
< 9.0.8-r7
- chainguard•apm-server-9.1
< 9.1.10-r6
- chainguard•apm-server-9.2
< 9.2.8-r1
- chainguard•apm-server-9.3
< 9.3.3-r1
- chainguard•apm-server-fips-8.17
< 8.17.10-r10
- chainguard•apm-server-fips-8.18
all
- chainguard•apm-server-fips-8.19
< 8.19.12-r5
- chainguard•apm-server-fips-9.0
< 9.0.8-r7
- chainguard•apm-server-fips-9.1
< 9.1.10-r7
- chainguard•apm-server-fips-9.2
< 9.2.8-r1
- chainguard•apm-server-fips-9.3
< 9.3.3-r1
- chainguard•argo-cd-2.14
all
- chainguard•argo-cd-2.14-compat
all
- chainguard•argo-cd-3.0
all
- chainguard•argo-cd-3.0-compat
all
- chainguard•argo-cd-3.1
< 3.1.13-r4
- chainguard•argo-cd-3.1-compat
< 3.1.13-r4
- chainguard•argo-cd-3.2
< 3.2.8-r4
- chainguard•argo-cd-3.2-compat
< 3.2.8-r4
- chainguard•argo-cd-3.3
< 3.3.7-r0 | < 3.3.6-r4
- chainguard•argo-cd-3.3-compat
< 3.3.7-r0
- chainguard•argo-cd-fips-2.14
all
- chainguard•argo-cd-fips-2.14-compat
all
- chainguard•argo-cd-fips-3.0
< 3.0.23-r9
- chainguard•argo-cd-fips-3.0-compat
< 3.0.23-r9
- chainguard•argo-cd-fips-3.1
< 3.1.13-r4
- chainguard•argo-cd-fips-3.1-compat
< 3.1.13-r4
- chainguard•argo-cd-fips-3.2
< 3.2.8-r4
- chainguard•argo-cd-fips-3.2-compat
< 3.2.8-r4
- chainguard•argo-cd-fips-3.3
< 3.3.11-r0
- chainguard•argo-cd-fips-3.3-compat
< 3.3.11-r0
- chainguard•argo-events
< 1.9.10-r27
- chainguard•argo-events-fips
< 1.9.10-r19
- chainguard•argo-rollouts
< 1.9.0-r17
- chainguard•argo-workflow-controller-3.6
< 3.6.19-r6
Showing first 50 affected entries in server-rendered view.
References (15)
- https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-hfvc-g4fc-pqhx
- http://github.com/open-telemetry/opentelemetry-go/releases/tag/v1.43.0
- https://github.com/open-telemetry/opentelemetry-go
- https://nvd.nist.gov/vuln/detail/CVE-2026-39883
- https://access.redhat.com/security/cve/CVE-2026-39883
- https://bugzilla.redhat.com/show_bug.cgi?id=2456718
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39883.json
- https://access.redhat.com/errata/RHSA-2026:26257
- https://access.redhat.com/errata/RHSA-2026:26254
- https://access.redhat.com/errata/RHSA-2026:37387
- https://access.redhat.com/errata/RHSA-2026:54286
- https://access.redhat.com/errata/RHSA-2026:54274
- https://www.suse.com/security/cve/CVE-2026-39883
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/39xxx/CVE-2026-39883.json
- https://access.redhat.com/errata/RHSA-2026:63140