DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-81192: CVE-2026-81192: Local Code Execution via Untrusted Search Path in OpenTelemetry.Resources.Host

#security #cve #cybersecurity

CVE-2026-81192: Local Code Execution via Untrusted Search Path in OpenTelemetry.Resources.Host

Vulnerability ID: CVE-2026-81192
CVSS Score: 7.0
Published: 2026-09-16

An untrusted search path vulnerability (CWE-426) in the OpenTelemetry.Resources.Host NuGet package on macOS allows a local attacker to execute arbitrary code with elevated privileges by hijacking standard system commands such as sh and ioreg.

TL;DR

A local PATH hijacking vulnerability in OpenTelemetry's host detector on macOS allows privilege escalation by placing malicious binaries in directories resolved ahead of system paths.

Technical Details

  • CWE ID: CWE-426
  • Attack Vector: Local (AV:L)
  • Attack Complexity: High (AC:H)
  • Privileges Required: Low (PR:L)
  • User Interaction: None (UI:N)
  • Scope: Unchanged (S:U)
  • EPSS Score: 0.00138
  • CISA KEV Status: Not Listed

Affected Systems

  • OpenTelemetry.Resources.Host on macOS
  • OpenTelemetry.Resources.Host: < 1.16.0-beta.2 (Fixed in: 1.16.0-beta.2)

Code Analysis

Commit: 476059d

Fix host.id resource detector on macOS to use absolute path for ioreg

diff --git a/src/OpenTelemetry.Resources.Host/HostDetector.cs b/src/OpenTelemetry.Resources.Host/HostDetector.cs\nindex b2febd703a..dd630cdb82 100644\n--- a/src/OpenTelemetry.Resources.Host/HostDetector.cs\n+++ b/src/OpenTelemetry.Resources.Host/HostDetector.cs\n@@ -186,8 +186,8 @@ private static IEnumerable<string> GetFilePaths()\n         {\n             var startInfo = new ProcessStartInfo\n             {\n-                FileName = \"sh\",\n-                Arguments = \"-c \\\"ioreg -rd1 -c IOPlatformExpertDevice\\\"\",\n+                FileName = \"/usr/sbin/ioreg\",\n+                Arguments = \"-rd1 -c IOPlatformExpertDevice\",\n                 UseShellExecute = false,\n                 CreateNoWindow = true,\n                 RedirectStandardOutput = true,
Enter fullscreen mode Exit fullscreen mode

Mitigation Strategies

  • Upgrade OpenTelemetry.Resources.Host to 1.16.0-beta.2 or later
  • Sanitize and restrict the PATH environment variable
  • Ensure system directories take priority in command resolution

Remediation Steps:

  1. Identify references to OpenTelemetry.Resources.Host in project files
  2. Update the NuGet dependency to version 1.16.0-beta.2 or later
  3. Rebuild and redeploy the affected .NET applications
  4. Verify process executions on macOS endpoints using EDR solutions

References

Read the full report for CVE-2026-81192 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)