CVE-2026-39883: OpenTelemetry-Go has an incomplete fix for CVE-2026-24051: BSD kenv command not using absolute path enables PATH hijacking

Modified

AliasesUBUNTU-CVE-2026-39883CGA-22ph-cf56-m54rCGA-22vh-2rv8-87ch+5277 more

Published 08-04-2026Last modified 09-09-2026

Vulnerability summary

CVE-2026-39883 is a high (CVSS 7.3) Untrusted Search Path vulnerability in open-telemetry opentelemetry-go. EPSS estimates a 0.25% chance of exploitation in the next 30 days, higher than 16.8% of scored vulnerabilities. 1 public exploit is recorded.

Priority

Prioritisepublic exploit

Public exploit (GitHub, Date unknown)

Source freshness unavailable

How is this decided?

CVSS score

7.3/10

010

High · v4.0 (CVE.org)

EPSS score

0.25%

0%100%

Low · +0.05 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits1github

Advisory lineage

Upstream 0 · Downstream 4 · Related 5

OPENSUSE-SU-2026:11173-1 OPENSUSE-SU-2026:21551-1 SUSE-SU-2026:23216-1 SUSE-SU-2026:23227-1 CGA-VPW6-RGJ5-PRPF

Timeline

08-04-2026
PublishedVulnerability first disclosed.
09-09-2026
Last modifiedVulnerability information updated.

Description

OpenTelemetry-Go is the Go implementation of OpenTelemetry. From 1.15.0 to 1.42.0, the fix for CVE-2026-24051 changed the Darwin ioreg command to use an absolute path but left the BSD kenv command using a bare name, allowing the same PATH hijacking attack on BSD and Solaris platforms. This vulnerability is fixed in 1.43.0.

CVSS metrics

9 scores · 6 sources · 2 versions

v4.07.3v3.17.0

EPSS trend

Probability

0.25%

Chance of exploitation in the next 30 days

Percentile

17%

Versus all other CVEs

30-day change

Increase +0.05 pp

From 0.21% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

1 found

githubUnverified
Opentelemetry Go
Maturity: poc

Weaknesses

CWE · root cause

CWE-426Untrusted Search PathThe product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.

Affected systems

Version check

Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard200 products

aactl< 0.4.12-r56
addon-resizer< 1.8.23-r22
addon-resizer-fips< 1.8.23-r22
agentbeat< 9.2.7-r4
agentbeat-fips< 9.2.7-r5

amazon-cloudwatch-agent< 1.300066.1-r1
amazon-cloudwatch-agent-fips< 1.300066.1-r1
amazon-eks-ami< 20260610-r1
amazon-eks-ami-fips< 20260610-r1
ansible-operator< 1.42.2-r8
ansible-operator-fips< 1.42.2-r7
apisix-ingress-controller< 2.0.1-r10
apm-server-8.17< 8.17.10-r11
apm-server-8.18All versions (No fix recorded)
apm-server-8.19< 8.19.14-r1
apm-server-9.0< 9.0.8-r7
apm-server-9.1< 9.1.10-r6
apm-server-9.2< 9.2.8-r1
apm-server-9.3< 9.3.3-r1
apm-server-fips-8.17< 8.17.10-r10
apm-server-fips-8.18All versions (No fix recorded)
apm-server-fips-8.19< 8.19.12-r5
apm-server-fips-9.0< 9.0.8-r7
apm-server-fips-9.1< 9.1.10-r7
apm-server-fips-9.2< 9.2.8-r1
apm-server-fips-9.3< 9.3.3-r1
argo-cd-2.14All versions (No fix recorded)
argo-cd-2.14-compatAll versions (No fix recorded)
argo-cd-3.0All versions (No fix recorded)
argo-cd-3.0-compatAll versions (No fix recorded)
argo-cd-3.1< 3.1.13-r4
argo-cd-3.1-compat< 3.1.13-r4
argo-cd-3.2< 3.2.8-r4
argo-cd-3.2-compat< 3.2.8-r4
argo-cd-3.3< 3.3.7-r0 | < 3.3.6-r4
argo-cd-3.3-compat< 3.3.7-r0
argo-cd-fips-2.14All versions (No fix recorded)
argo-cd-fips-2.14-compatAll versions (No fix recorded)
argo-cd-fips-3.0< 3.0.23-r9
argo-cd-fips-3.0-compat< 3.0.23-r9
argo-cd-fips-3.1< 3.1.13-r4
argo-cd-fips-3.1-compat< 3.1.13-r4
argo-cd-fips-3.2< 3.2.8-r4
argo-cd-fips-3.2-compat< 3.2.8-r4
argo-cd-fips-3.3< 3.3.11-r0
argo-cd-fips-3.3-compat< 3.3.11-r0
argo-events< 1.9.10-r27
argo-events-fips< 1.9.10-r19
argo-rollouts< 1.9.0-r17
argo-workflow-controller-3.6< 3.6.19-r6
argo-workflow-controller-3.7< 3.7.13-r2
argo-workflow-controller-4.0< 4.0.4-r3
argo-workflow-controller-fips-3.6< 3.6.19-r7
argo-workflow-controller-fips-3.7< 3.7.13-r5
argo-workflow-controller-fips-4.0< 4.0.5-r5
argo-workflow-executor-3.6< 3.6.19-r6
argo-workflow-executor-3.7< 3.7.13-r2
argo-workflow-executor-4.0< 4.0.4-r3
argo-workflow-executor-fips-3.6< 3.6.19-r7
argo-workflow-executor-fips-3.7< 3.7.13-r5
argo-workflow-executor-fips-4.0< 4.0.5-r5
argo-workflows-3.6< 3.6.19-r6
argo-workflows-3.7< 3.7.13-r2
argo-workflows-4.0< 4.0.4-r3
argo-workflows-fips-3.6< 3.6.19-r7
argo-workflows-fips-3.7< 3.7.13-r5
argo-workflows-fips-4.0< 4.0.5-r5
argocd-image-updater< 1.1.1-r9
argocd-image-updater-fips< 1.1.1-r9
atlas-1.0< 1.0.0-r3
atlas-1.0-fips< 1.0.0-r2
atlas-1.1< 1.1.0-r2
atlas-1.1-fips< 1.1.0-r2
auditbeat-8.17< 8.17.10-r25
auditbeat-9.0< 9.0.8-r13
auditbeat-fips-8.17< 8.17.10-r23
auditbeat-fips-9.0< 9.0.8-r14
auditbeat-fips-9.1< 9.1.10-r10
auditbeat-fips-9.2< 9.2.8-r1
authentik-2025.12-go-server< 2025.12.6-r15
authentik-2026.2-go-server< 2026.2.4-r5
authentik-fips-2025.12-go-server< 2025.12.6-r15
authentik-fips-2026.2-go-server< 2026.2.4-r4
aws-ebs-csi-driver-1.50< 1.50.3-r8
aws-ebs-csi-driver-1.51< 1.51.2-r8
aws-ebs-csi-driver-1.52< 1.52.1-r9
aws-ebs-csi-driver-1.53< 1.53.0-r8
aws-ebs-csi-driver-1.54< 1.54.0-r8
aws-ebs-csi-driver-1.55< 1.55.0-r5
aws-ebs-csi-driver-1.56< 1.56.0-r5
aws-ebs-csi-driver-1.57< 1.57.1-r2
aws-ebs-csi-driver-1.58< 1.58.0-r1
aws-ebs-csi-driver-fips-1.50< 1.50.3-r8
aws-ebs-csi-driver-fips-1.51< 1.51.2-r9
aws-ebs-csi-driver-fips-1.52< 1.52.1-r12
aws-ebs-csi-driver-fips-1.53< 1.53.0-r8
aws-ebs-csi-driver-fips-1.54< 1.54.0-r7
aws-ebs-csi-driver-fips-1.55< 1.55.0-r7
aws-ebs-csi-driver-fips-1.56< 1.56.0-r6
aws-ebs-csi-driver-fips-1.57< 1.57.1-r1
aws-ebs-csi-driver-fips-1.58< 1.58.0-r1
aws-fsx-csi-driver< 1.9.0-r6
aws-fsx-csi-driver-fips< 1.9.0-r8
aws-node-termination-handler< 1.25.6-r3
aws-node-termination-handler-fips< 1.25.6-r1
aws-otel-collector< 0.47.0-r11
aws-otel-collector-fips< 0.47.0-r8
azcopy< 10.32.3-r1
azcopy-fips< 10.32.3-r1
azure-service-operator< 2.18.0-r6
azure-service-operator-fips< 2.18.0-r5
azure-workload-identity-webhook< 1.5.1-r15
azuredisk-csi-1.31All versions (No fix recorded)
azuredisk-csi-1.32< 1.32.12-r7
azuredisk-csi-1.33< 1.33.8-r9
azuredisk-csi-1.34< 1.34.2-r6
azuredisk-csi-fips-1.31All versions (No fix recorded)
azuredisk-csi-fips-1.32< 1.32.12-r8
azuredisk-csi-fips-1.33< 1.33.8-r8
azuredisk-csi-fips-1.34< 1.34.2-r5
azurefile-csi-1.31All versions (No fix recorded)
azurefile-csi-1.32All versions (No fix recorded)
azurefile-csi-1.33< 1.33.8-r5
azurefile-csi-1.34< 1.34.4-r6
azurefile-csi-1.35< 1.35.1-r9
azurefile-csi-fips-1.31All versions (No fix recorded)
azurefile-csi-fips-1.32All versions (No fix recorded)
azurefile-csi-fips-1.33< 1.33.8-r6
azurefile-csi-fips-1.34< 1.34.4-r5
azurefile-csi-fips-1.35< 1.35.1-r5
backup-restore-operator-10.0< 10.0.0-r1
backup-restore-operator-7.0< 7.0.5-r6
backup-restore-operator-8.1< 8.1.3-r2
backup-restore-operator-9.0< 9.0.2-r2
backup-restore-operator-fips-10.0< 10.0.0-r1 | < 10.0.4-r1
backup-restore-operator-fips-7.0< 7.0.5-r7
backup-restore-operator-fips-8.1< 8.1.3-r2
backup-restore-operator-fips-9.0< 9.0.3-r2
bank-vaults< 1.32.1-r18
bank-vaults-fips< 1.32.1-r7
bank-vaults-template< 1.32.1-r18
bank-vaults-template-fips< 1.32.1-r7
bento< 1.16.2-r2
bento-fips< 1.16.2-r2
blob-csi-1.23< 1.23.11-r77
blob-csi-1.24< 1.24.11-r24
blob-csi-1.25< 1.25.10-r14
blob-csi-1.26< 1.26.10-r5
blob-csi-1.27< 1.27.3-r4
blob-csi-fips-1.23< 1.23.11-r77
blob-csi-fips-1.24< 1.24.11-r26
blob-csi-fips-1.25< 1.25.10-r14
blob-csi-fips-1.26< 1.26.10-r5
blob-csi-fips-1.27< 1.27.3-r5
boring-registry< 0.17.0-r2
boring-registry-fips< 0.16.6-r14
buildctl< 0.29.0-r4
buildctl-fips< 0.30.0-r3
buildkitd< 0.29.0-r4
buildkitd-fips< 0.30.0-r3
caddy< 2.11.2-r10
caddy-fips< 2.11.2-r6
cadence-fips-server< 1.4.1-r1
cadence-server< 1.4.1-r1
cadvisor< 0.60.1-r1
cadvisor-compat< 0.60.5-r8
cadvisor-fips< 0.60.1-r1
calico-apiserver-3.29All versions (No fix recorded)
calico-apiserver-3.30< 3.30.7-r3
calico-apiserver-3.31< 3.31.4-r6
calico-apiserver-fips-3.29All versions (No fix recorded)
calico-apiserver-fips-3.30< 3.30.7-r2
calico-apiserver-fips-3.31< 3.31.4-r6
calico-felix-3.30< 3.30.7-r3
calico-felix-fips-3.30< 3.30.7-r2
calico-goldmane-3.30< 3.30.7-r3
calico-goldmane-fips-3.30< 3.30.7-r2
calico-kube-controllers-3.29All versions (No fix recorded)
calico-kube-controllers-3.30< 3.30.7-r3
calico-kube-controllers-3.31< 3.31.4-r6
calico-kube-controllers-fips-3.29All versions (No fix recorded)
calico-kube-controllers-fips-3.30< 3.30.7-r2
calico-kube-controllers-fips-3.31< 3.31.4-r6
calico-node-3.30< 3.30.7-r3
calico-node-fips-3.30< 3.30.7-r2
calico-whisker-backend-3.30< 3.30.7-r3
calico-whisker-backend-fips-3.30< 3.30.7-r2
cass-operator< 1.30.0-r4
cass-operator-fips< 1.30.0-r2
cass-operator-fips-no-pvc-delete< 1.30.0-r1
ceph-csi-operator< 0.6.0-r1
ceph-csi-operator-fips< 0.6.0-r1
cerbos< 0.51.0-r15
cerbos-fips< 0.51.0-r10
cerbosctl-fips< 0.51.0-r10
cert-manager-1.18All versions (No fix recorded)
cert-manager-1.19< 1.19.4-r5
cert-manager-1.20< 1.20.2-r0
cert-manager-acmesolver-1.18All versions (No fix recorded)
cert-manager-acmesolver-fips-1.18< 1.18.6-r3

Show all 200

1 vendor · 200 products · Showing 200 of 2736

References

17 links

github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-hfvc-g4fc-pqhxX Refsource CONFIRMREPORTAdvisoryWEBExploitThird Party Advisory
github.com/open-telemetry/opentelemetry-go/releases/tag/v1.43.0X Refsource MISCREPORTWEBRelease Notes
access.redhat.com/security/cve/CVE-2026-39883VDB EntryX Refsource REDHATAdvisory
bugzilla.redhat.com/show_bug.cgi?id=2456718Issue TrackingX Refsource REDHATREPORT
security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39883.jsonX Sadp Csaf VexWEB
access.redhat.com/errata/RHSA-2026:63140Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:54286Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:54274Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:37387Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:26257Vendor AdvisoryX Refsource REDHATAdvisory

Show all 17 references

access.redhat.com/errata/RHSA-2026:26254Vendor AdvisoryX Refsource REDHATAdvisory
ubuntu.com/security/CVE-2026-39883REPORT
www.cve.org/CVERecord?id=CVE-2026-39883REPORT
github.com/CVEProject/cvelistV5/tree/main/cves/2026/39xxx/CVE-2026-39883.jsonAdvisory
nvd.nist.gov/vuln/detail/CVE-2026-39883Advisory
github.com/open-telemetry/opentelemetry-goPACKAGE
www.suse.com/security/cve/CVE-2026-39883WEB