CVE-2026-81192: Local Code Execution via Untrusted Search Path in OpenTelemetry.Resources.Host

Vulnerability ID: CVE-2026-81192
CVSS Score: 7.0
Published: 2026-09-16

An untrusted search path vulnerability (CWE-426) in the OpenTelemetry.Resources.Host NuGet package on macOS allows a local attacker to execute arbitrary code with elevated privileges by hijacking standard system commands such as sh and ioreg.

TL;DR

A local PATH hijacking vulnerability in OpenTelemetry's host detector on macOS allows privilege escalation by placing malicious binaries in directories resolved ahead of system paths.

Technical Details

• CWE ID: CWE-426
• Attack Vector: Local (AV:L)
• Attack Complexity: High (AC:H)
• Privileges Required: Low (PR:L)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• EPSS Score: 0.00138
• CISA KEV Status: Not Listed

Affected Systems

• OpenTelemetry.Resources.Host on macOS
• OpenTelemetry.Resources.Host: < 1.16.0-beta.2 (Fixed in: 1.16.0-beta.2)

Code Analysis

Commit: 476059d

Fix host.id resource detector on macOS to use absolute path for ioreg

diff --git a/src/OpenTelemetry.Resources.Host/HostDetector.cs b/src/OpenTelemetry.Resources.Host/HostDetector.cs\nindex b2febd703a..dd630cdb82 100644\n--- a/src/OpenTelemetry.Resources.Host/HostDetector.cs\n+++ b/src/OpenTelemetry.Resources.Host/HostDetector.cs\n@@ -186,8 +186,8 @@ private static IEnumerable<string> GetFilePaths()\n         {\n             var startInfo = new ProcessStartInfo\n             {\n-                FileName = \"sh\",\n-                Arguments = \"-c \\\"ioreg -rd1 -c IOPlatformExpertDevice\\\"\",\n+                FileName = \"/usr/sbin/ioreg\",\n+                Arguments = \"-rd1 -c IOPlatformExpertDevice\",\n                 UseShellExecute = false,\n                 CreateNoWindow = true,\n                 RedirectStandardOutput = true,

Mitigation Strategies

• Upgrade OpenTelemetry.Resources.Host to 1.16.0-beta.2 or later
• Sanitize and restrict the PATH environment variable
• Ensure system directories take priority in command resolution

Remediation Steps:

1. Identify references to OpenTelemetry.Resources.Host in project files
2. Update the NuGet dependency to version 1.16.0-beta.2 or later
3. Rebuild and redeploy the affected .NET applications
4. Verify process executions on macOS endpoints using EDR solutions

References

• GitHub Security Advisory GHSA-v8pv-4842-x354
• NVD CVE-2026-81192 Details
• CVE-2026-81192 Record

Read the full report for CVE-2026-81192 on our website for more details including interactive diagrams and full exploit analysis.