Skip to content
Fencer Intel
high 8.8

CVE-2026-39883 json

OpenTelemetry-Go has an incomplete fix for CVE-2026-24051: BSD kenv command not using absolute path enables PATH hijacking

published 7mo ago modified last mo. also GHSA-hfvc-g4fc-pqhx , GO-2026-5426 , EUVD-2026-20630

cvss
8.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 18%
public exploits
0
none known

Summary

OpenTelemetry-Go is the Go implementation of OpenTelemetry. From 1.15.0 to 1.42.0, the fix for CVE-2026-24051 changed the Darwin ioreg command to use an absolute path but left the BSD kenv command using a bare name, allowing the same PATH hijacking attack on BSD and Solaris platforms. This vulnerability is fixed in 1.43.0.

Patch / fix

  • go go.opentelemetry.io/otel/sdk 1.43.0
  • Red Hat Cert Manager support for Red Hat OpenShift release 1.19 1788348594
  • Red Hat multicluster engine for Kubernetes 2.8 1781539691, 1781539725
  • Red Hat Red Hat Openshift Data Foundation 4.22 1782931768, 1782932104, 1782932114, 1782932521, 1782932812, 1782932919, 1782932969, 1782933015, 1782933042, 1782933235, 1782933251, 1783018421, 1783018461, 1783535989, 1783536000, 1783536515, 1783537001, 1783537392, 1783537586, 1783537955
  • Red Hat Red Hat OpenShift Workload Availability 0.3 1785203474
  • Red Hat Red Hat OpenShift Workload Availability 0.8 1785203079
  • govulncheck-vulndb SLES 16.0, SLES for SAP applications 16.0 0.0.20260727T201416-160000.1.1

suse advisories SUSE-SU-2026:23216-1SUSE-SU-2026:23227-1

  • clusterctl openSUSE Tumbleweed 1.14.0-1.1
  • govulncheck-vulndb openSUSE Leap 16.0 0.0.20260727T201416-160000.1.1
  • etcd openSUSE Tumbleweed 3.6.13-1.1

opensuse advisories openSUSE-SU-2026:11494-1openSUSE-SU-2026:21551-1openSUSE-SU-2026:11173-1

Is CVE-2026-39883 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-39883 updated cvss 8.8

github.com/open-telemetry/opentelemetry-go: OpenTelemetry-Go: Arbitrary code execution via PATH hijacking on BSD/Solaris

  • Red Hat Fence Agents Remediation Operator redhat-user-workloads/rhwa-tenant/fence-agents-remediation/far-operator-0-8 Red Hat OpenShift AI (RHOAI) rhoai/odh-mlflow-operator-rhel9, rhoai/odh-kuberay-operator-controller-rhel9 Red Hat Storage-Based Remediation redhat-user-workloads/rhwa-tenant/storage-based-remediation/sbr-operator-0-3
    affected: no fix available
  • Red Hat Cert Manager support for Red Hat OpenShift release 1.19 cert-manager/cert-manager-istio-csr-rhel9 1788348594
    fixed: vendor fix RHSA-2026:63140
  • Red Hat Cert Manager support for Red Hat OpenShift release 1.20 cert-manager/cert-manager-istio-csr-rhel9 1790223719, cert-manager/cert-manager-istio-csr-rhel9 1790589914
    fixed: vendor fix RHSA-2026:72475
  • Red Hat multicluster engine for Kubernetes 2.8 multicluster-engine/assisted-service-8-rhel8 1781539691, multicluster-engine/assisted-service-9-rhel9 1781539725
    fixed: vendor fix RHSA-2026:26257
  • Red Hat Openshift Data Foundation 4.22 odf4/cephcsi-rhel9 1782932114, odf4/odf-cli-rhel9 1783537001, odf4/mcg-core-rhel9 1783536000, odf4/odf-drbd-rhel9 1783537392, odf4/odf-console-rhel9 1783537586, odf4/devicefinder-rhel9 1782932104, +21 more
    fixed: vendor fix RHSA-2026:37387
  • Red Hat OpenShift Workload Availability 0.3 workload-availability/storage-based-remediation-rhel9-operator 1785203474
    fixed: vendor fix RHSA-2026:54286
  • Red Hat OpenShift Workload Availability 0.8 workload-availability/fence-agents-remediation-rhel9-operator 1785203079
    fixed: vendor fix RHSA-2026:54274
  • Red Hat multicluster engine for Kubernetes 2.8 multicluster-engine/assisted-installer-rhel9 1781593211, multicluster-engine/assisted-image-service-rhel9 1781592435, multicluster-engine/assisted-installer-agent-rhel9 1781592447, multicluster-engine/assisted-installer-controller-rhel9 1781592399 Red Hat Openshift Data Foundation 4.22 odf4/mcg-operator-bundle 1783538986, odf4/ocs-operator-bundle 1783539176, odf4/odf-operator-bundle 1783539513, odf4/cephcsi-operator-bundle 1783538908, odf4/odr-hub-operator-bundle 1783539596, odf4/rook-ceph-operator-bundle 1783539714, +10 more Red Hat OpenShift Workload Availability 0.3 workload-availability/storage-based-remediation-agent-rhel9 1785203394, workload-availability/storage-based-remediation-operator-bundle 1785204415 Red Hat OpenShift Workload Availability 0.8 workload-availability/fence-agents-remediation-operator-bundle 1785204008
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
6mo ago

Exploit prediction

0.26% chance of exploitation in the next 30 days, higher than 18% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • github.com https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-hfvc-g4fc-pqhx referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 4.0 7.3 CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADP 3.1 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CISA ADP 3.1 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CNA 4.0 7.3 CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD 3.1 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA 3.1 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA 3.1 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
go go.opentelemetry.io/otel/sdk
>=1.15.0, <1.43.0
1.43.0

Affected products

  • open-telemetry opentelemetry-go
  • Red Hat Cert Manager support for Red Hat OpenShift release 1.19
  • Red Hat multicluster engine for Kubernetes 2.8
  • Red Hat Red Hat Openshift Data Foundation 4.22
  • Red Hat Red Hat OpenShift Workload Availability 0.3
  • Red Hat Red Hat OpenShift Workload Availability 0.8

Classification

Weakness

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.