CVE-2026-39883
ADVISORY - githubSummary
Summary
The fix for GHSA-9h8m-3fm2-qjrq (CVE-2026-24051) changed the Darwin ioreg command to use an absolute path but left the BSD kenv command using a bare name, allowing the same PATH hijacking attack on BSD and Solaris platforms.
Root Cause
sdk/resource/host_id.go line 42:
if result, err := r.execCommand("kenv", "-q", "smbios.system.uuid"); err == nil {
Compare with the fixed Darwin path at line 58:
result, err := r.execCommand("/usr/sbin/ioreg", "-rd1", "-c", "IOPlatformExpertDevice")
The execCommand helper at sdk/resource/host_id_exec.go uses exec.Command(name, arg...) which searches $PATH when the command name contains no path separator.
Affected platforms (per build tag in host_id_bsd.go:4): DragonFly BSD, FreeBSD, NetBSD, OpenBSD, Solaris.
The kenv path is reached when /etc/hostid does not exist (line 38-40), which is common on FreeBSD systems.
Attack
- Attacker has local access to a system running a Go application that imports
go.opentelemetry.io/otel/sdk - Attacker places a malicious
kenvbinary earlier in$PATH - Application initializes OpenTelemetry resource detection at startup
hostIDReaderBSD.read()callsexec.Command("kenv", ...)which resolves to the malicious binary- Arbitrary code executes in the context of the application
Same attack vector and impact as CVE-2026-24051.
Suggested Fix
Use the absolute path:
if result, err := r.execCommand("/bin/kenv", "-q", "smbios.system.uuid"); err == nil {
On FreeBSD, kenv is located at /bin/kenv.
NIST
1
CVSS SCORE
7.3highGitHub
-
CVSS SCORE
7.3highDebian
-
CVSS SCORE
N/AlowUbuntu
-
CVSS SCORE
N/AmediumChainguard
CGA-vpw6-rgj5-prpf
-
minimos
MINI-22mg-6qj6-fxq2
-
minimos
MINI-26xq-hqfj-xj36
-
minimos
MINI-2g8v-82mw-98vx
-
minimos
MINI-2hmr-6hfm-r55c
-
minimos
MINI-2jwh-rwv2-6xph
-
minimos
MINI-2wcx-gmgj-rw9c
-
minimos
MINI-32m9-w5pm-9jf6
-
minimos
MINI-33pv-77j7-h84w
-
minimos
MINI-348v-8qrw-x977
-
minimos
MINI-3hvx-p433-5v6m
-
minimos
MINI-3vmw-6r5r-75w5
-
minimos
MINI-48f2-xx5m-36wx
-
minimos
MINI-49q8-jwvg-jq5q
-
minimos
MINI-4gxv-gm82-r8m6
-
minimos
MINI-5c4q-7cwc-pfqj
-
minimos
MINI-5f9q-45r6-m3vg
-
minimos
MINI-5fw7-xmwv-p79c
-
minimos
MINI-5g4p-fw6h-hvvh
-
minimos
MINI-5vw3-mxqc-f7w7
-
minimos
MINI-5w7r-7735-fqrw
-
minimos
MINI-63x3-fwqj-gh62
-
minimos
MINI-67pv-2qgw-jp5w
-
minimos
MINI-68rc-f2qg-wv93
-
minimos
MINI-6948-c28v-6gxc
-
minimos
MINI-6fv2-gm3g-f6cw
-
minimos
MINI-6jj2-28cw-jrmj
-
minimos
MINI-6jrj-4xvq-4j8x
-
minimos
MINI-6mqx-gx7h-c8h3
-
minimos
MINI-6p78-r653-3q89
-
minimos
MINI-6w6q-j49f-hmmw
-
minimos
MINI-7fm6-85xm-84c8
-
minimos
MINI-7px7-jwj7-m7f7
-
minimos
MINI-7q57-j9ch-q9jf
-
minimos
MINI-838j-v8qj-gf5x
-
minimos
MINI-847c-82p9-7fq5
-
minimos
MINI-84j2-cv7v-5pjx
-
minimos
MINI-85v8-vw95-xgfr
-
minimos
MINI-85x7-fcvr-77w8
-
minimos
MINI-8cm3-4vcq-f9q3
-
minimos
MINI-8hcf-pcwp-h72f
-
minimos
MINI-8j2c-22hm-xpq6
-
minimos
MINI-8pfr-gf5j-rgqj
-
minimos
MINI-9q6r-pxvp-35x4
-
minimos
MINI-9rqh-r98h-78v5
-
minimos
MINI-9vr3-h96f-mrxx
-
minimos
MINI-c62j-h6p2-p5h6
-
minimos
MINI-c75p-2chc-3q8c
-
minimos
MINI-c7j6-v9mv-3gf2
-
minimos
MINI-c7rc-c6g7-vw76
-
minimos
MINI-f6wv-r8w3-p677
-
minimos
MINI-fccv-g6hg-vppf
-
minimos
MINI-g29f-gx37-9562
-
minimos
MINI-g89j-rmc4-3fp5
-
minimos
MINI-gm7f-xqv4-h9wr
-
minimos
MINI-grqh-v7g4-4qh9
-
minimos
MINI-h386-p533-wj9f
-
minimos
MINI-hcjp-qf74-xpj8
-
minimos
MINI-hjpc-hgjj-v235
-
minimos
MINI-hx7w-q2hm-rpv3
-
minimos
MINI-j4w9-66cq-5qmf
-
minimos
MINI-jr2w-w2pf-86m3
-
minimos
MINI-m2wh-jjjq-8g8f
-
minimos
MINI-m958-c4xw-2xxf
-
minimos
MINI-mcrr-fm67-3w6j
-
minimos
MINI-mfxr-7h9h-p2rm
-
minimos
MINI-mwgx-8h74-35h6
-
minimos
MINI-p2j5-g5gc-6xh5
-
minimos
MINI-p2jv-cwm5-5x8f
-
minimos
MINI-p79m-5g29-6rrj
-
minimos
MINI-p959-pf63-c4mm
-
minimos
MINI-pfr4-mfpm-27h2
-
minimos
MINI-pmg9-m69r-mpg9
-
minimos
MINI-q649-54vj-88m4
-
minimos
MINI-q9j5-qxcr-566x
-
minimos
MINI-q9pw-5825-wf87
-
minimos
MINI-qfmr-x927-x3p2
-
minimos
MINI-qhvp-9fvj-7c97
-
minimos
MINI-qmr5-3qfm-4w2x
-
minimos
MINI-qwh6-g2vx-6rpm
-
minimos
MINI-r5qc-hhcq-r89w
-
minimos
MINI-r72h-6phx-gv4c
-
minimos
MINI-r72r-28w6-r5hq
-
minimos
MINI-r7rm-j9w9-rvr6
-
minimos
MINI-rp34-65cr-4cc9
-
minimos
MINI-rw64-pj39-wmx3
-
minimos
MINI-rw6m-vxr8-rmg9
-
minimos
MINI-v4ww-4cc3-8g26
-
minimos
MINI-v9hf-4jr9-xpfg
-
minimos
MINI-vgqf-fqr5-m5c7
-
minimos
MINI-vhgf-wpcx-7mm7
-
minimos
MINI-vhpc-75m9-22hh
-
minimos
MINI-vm6j-f2qv-7c87
-
minimos
MINI-vvj9-vc7r-r5p3
-
minimos
MINI-vxwf-89hx-g2c6
-
minimos
MINI-w98v-pg7c-545g
-
minimos
MINI-wh26-r558-q8x3
-
minimos
MINI-wjq9-x9pm-3rg3
-
minimos
MINI-x2qq-q83v-2r8v
-
minimos
MINI-x74m-q784-hp8h
-
minimos
MINI-x86x-fcqg-92rw
-
minimos
MINI-x88w-pgr5-m64x
-
minimos
MINI-x8c9-jjxf-m9fr
-
minimos
MINI-x8rp-6cfc-93w5
-
minimos
MINI-x9ff-cpx9-7r7w
-
minimos
MINI-x9qq-5fv8-6wg9
-
minimos
MINI-xc2c-477g-jwr5
-
minimos
MINI-xc6j-v6q3-44xj
-
minimos
MINI-xfch-wmrh-8xf5
-
minimos
MINI-xg65-2rfp-m88w
-
minimos
MINI-xjcj-mhmh-64j2
-