CVE-2026-81192 OpenTelemetry.Resources.Host vulnerable to arbitrary code execution via local PATH hijacking on macOS
A local attacker can execute arbitrary code via PATH hijacking in the OpenTelemetry Host resource detector on macOS, leading to privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-81192?
CVE-2026-81192 is a high-severity command injection vulnerability in open-telemetry opentelemetry-dotnet-contrib, published on 8 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
`OpenTelemetry.Resources.Host` NuGet package, which provides OpenTelemetry resource detectors for host, is affected by an untrusted search path vulnerability on macOS. Prior to version 1.16.0-beta.2, the `host.id` resource attribute detector launches the `sh` and `ioreg` executables by bare name rather than by absolute path, so both are resolved through the `PATH` environment variable. A local attacker who is less privileged than the host application, and who can influence `PATH` or write to a directory that appears in `PATH` ahead of the system directories, can have an arbitrary binary executed in the application's security context, resulting in local code execution/privilege escalation. This vulnerability only affect macOS hosts - Linux and Windows hosts are unaffected. Version 1.16.0-beta.2 contains a patch. No known workarounds are available.
Weakness: CWE-426
Which versions are affected by CVE-2026-81192?
2 open source packages ship an affected version, including OpenTelemetry.Resources.Host.
| Package | Affected | Fixed in |
|---|---|---|
OpenTelemetry.Resources.Host NuGet | All versions | 1.16.0-beta.2 |
OpenTelemetry.Resources.Host NuGet | All versions | 1.16.0-beta.2 |
How do I fix CVE-2026-81192?
Upgrade OpenTelemetry.Resources.Host to 1.16.0-beta.2 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-81192 being exploited?
There is no known exploitation of CVE-2026-81192 in the wild and no public exploit code.
Sources
Also known as GHSA-v8pv-4842-x354.