Vulnetix
Try Vulnetix Request Demo
CVE-2026-39883 PUBLISHED CVSS 7.300000190734863 HIGH

OpenTelemetry-Go is the Go implementation of OpenTelemetry. From 1.15.0 to 1.42.0, the fix for CVE-2026-24051 changed the Darwin ioreg command to use an absolute path but left the BSD kenv command using a bare name, allowing the same PATH hijacking attack on BSD and Solaris platforms. This vulnerability is fixed in 1.43.0.

EPSS 0.01% · 0.3th percentile

Risk Scores

CVSS v4.0
7.300000190734863
CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS Score
0.01%
0.3th percentile

Affected Products

VendorProductVersions
open-telemetryopentelemetry-go>= 1.15.0, < 1.43.0
go.opentelemetry.iootel/sdk1.15.0

Timeline

References

Open in Interactive Console →