CVE-2026-81192: OpenTelemetry.Resources.Host vulnerable to arbitrary code execution via local PATH hijacking on macOS
The OpenTelemetry.Resources.Host NuGet package is affected by an untrusted search path vulnerability on macOS. The host.id resource attribute detector launches the sh and ioreg executables by bare name rather than by absolute path, so both are resolved
through the PATH environment variable.
A local attacker who is less privileged than the host application, and who can influence PATH or write to a directory that appears in PATH ahead of the system directories, can have an arbitrary binary executed in the application’s security context, resulting in local
code execution/privilege escalation.
References
- github.com/advisories/GHSA-v8pv-4842-x354
- github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/1631
- github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/4760
- github.com/open-telemetry/opentelemetry-dotnet-contrib/security/advisories/GHSA-v8pv-4842-x354
- nvd.nist.gov/vuln/detail/CVE-2026-81192
Code Behaviors & Features
Detect and mitigate CVE-2026-81192 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →