Read the docs
TI-2026-28762 Aliases CVE-2026-39883GHSA-hfvc-g4fc-pqhx

Untrusted search path in open-telemetry opentelemetry-go

Priority LOW 34CWE-426Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
High
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 6 fixed, 3 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-426.

Summary

OpenTelemetry-Go is the Go implementation of OpenTelemetry. From 1.15.0 to 1.42.0, the fix for CVE-2026-24051 changed the Darwin ioreg command to use an absolute path but left the BSD kenv command using a bare name, allowing the same PATH hijacking attack on BSD and Solaris platforms. This vulnerability is fixed in 1.43.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00262 18th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial opentelemetry-go (open-telemetry): 1.43.0go.opentelemetry.io/otel/sdk (Go): 1.43.0Red Hat: 8 advisoriesRed Hat: 6 fixed, 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
open-telemetryopentelemetry-go1.15.0 to before 1.43.01.43.0Patch availableCNA
—go.opentelemetry.io/otel/sdk (Go)1.15.0 to before 1.43.01.43.0Patch availableGHSA-hfvc-g4fc-pqhx
  • opentelemetry-go Vendoropen-telemetry Affected 1.15.0 to before 1.43.0 Fixed in 1.43.0 Patch available CNA
  • go.opentelemetry.io/otel/sdk (Go) Vendor— Affected 1.15.0 to before 1.43.0 Fixed in 1.43.0 Patch available GHSA-hfvc-g4fc-pqhx

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:opentelemetry:opentelemetry:*:*:*:*:*:go:*:*1.15.0 to before 1.43.0Vulnerableopen-telemetry
  • cpe:2.3:a:opentelemetry:opentelemetry:*:*:*:*:*:go:*:* Versions 1.15.0 to before 1.43.0 Vulnerable ·open-telemetry

Remediation

  • Fix · CNA opentelemetry-go (open-telemetry) Fixed in 1.43.0
  • Fix · GHSA-hfvc-g4fc-pqhx go.opentelemetry.io/otel/sdk (Go) Fixed in 1.43.0 Advisory →

Red Hat 8 advisories

  • RHSA-2026:72475 Released 2026-09-28 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.20.1
    • Cert Manager support for Red Hat OpenShift release 1.20 registry.redhat.io/cert-manager/cert-manager-istio-csr-rhel9
  • RHSA-2026:72395 Released 2026-09-28 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.20.1
    • Cert Manager support for Red Hat OpenShift release 1.20 registry.redhat.io/cert-manager/cert-manager-istio-csr-rhel9
  • RHSA-2026:63140 Released 2026-09-03 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.19.2
    • Cert Manager support for Red Hat OpenShift release 1.19 registry.redhat.io/cert-manager/cert-manager-istio-csr-rhel9
Show 5 more Red Hat advisories
  • RHSA-2026:54286 Released 2026-08-12 · Red Hat rating Important
    Red Hat OpenShift Workload Availability Operator v0.3.1 security update
    • Red Hat OpenShift Workload Availability 0.3 registry.redhat.io/workload-availability/storage-based-remediation-rhel9-operator
  • RHSA-2026:54274 Released 2026-08-12 · Red Hat rating Important
    Red Hat OpenShift Workload Availability Operator v0.8.1 security update
    • Red Hat OpenShift Workload Availability 0.8 registry.redhat.io/workload-availability/fence-agents-remediation-rhel9-operator
  • RHSA-2026:37387 Released 2026-07-09 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.22.0 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.22 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/devicefinder-rhel9 +24
  • RHSA-2026:26257 Released 2026-06-16 · Red Hat rating Important
    Assisted Installer RHEL 8 components for Multicluster Engine for Kubernetes 2.8.8
    • multicluster engine for Kubernetes 2.8 registry.redhat.io/multicluster-engine/assisted-service-8-rhel8
  • RHSA-2026:26254 Released 2026-06-16 · Red Hat rating Important
    Assisted Installer RHEL 9 components for Multicluster Engine for Kubernetes 2.8.8
    • multicluster engine for Kubernetes 2.8 registry.redhat.io/multicluster-engine/assisted-service-9-rhel9

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Fence Agents Remediation OperatorAffectedNo fix yet
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet
Storage-Based RemediationAffectedNo fix yet
Cert Manager support for Red Hat OpenShift release 1.19Fixed RHSA-2026:63140
Cert Manager support for Red Hat OpenShift release 1.20Fixed RHSA-2026:72395, RHSA-2026:72475
Red Hat OpenShift Workload Availability 0.3Fixed RHSA-2026:54286
Red Hat OpenShift Workload Availability 0.8Fixed RHSA-2026:54274
Red Hat Openshift Data Foundation 4.22Fixed RHSA-2026:37387
multicluster engine for Kubernetes 2.8Fixed RHSA-2026:26254, RHSA-2026:26257
Not affected: 4 products
  • Red Hat OpenShift Workload Availability 0.3
  • Red Hat OpenShift Workload Availability 0.8
  • Red Hat Openshift Data Foundation 4.22
  • multicluster engine for Kubernetes 2.8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-39883
  2. 2026-10-03 Alias added: GHSA-hfvc-g4fc-pqhx
  3. 2026-10-15 Affected versions changed · Red Hat
  4. 2026-11-06 Affected versions changed · Red Hat

References

Exploit 1

Advisory 1

Other 2

  • TI-2026-23298 OpenTelemetry-Go multi-value `baggage` header extraction causes excessive allocations (remote dos amplification) CVSS 3.1HIGH 7.5
  • TI-2023-25448 DoS vulnerability in otelgrpc (uncontrolled resource consumption) due to unbound cardinality metrics CVSS 3.1HIGH 7.5
  • TI-2026-29801 OpenTelemetry-Go's baggage parsing no longer caps raw header length CVSS 3.1MEDIUM 5.3
  • TI-2026-32829 opentelemetry-cpp: OTLP HTTP exporters read unbounded HTTP response CVSS 3.1MEDIUM 5.3
  • TI-2023-23498 opentelemetry-instrumentation Denial of Service vulnerability due to unbound cardinality metrics CVSS 3.1HIGH 7.5
  • TI-2023-24163 OpenTelemetry-Go Contrib has DoS vulnerability in otelhttp due to unbound cardinality metrics CVSS 3.1HIGH 7.5
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences