{"uuid": "ee9071ac-ca07-4382-8af6-deaa5e110636", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-81192", "type": "seen", "source": "https://gist.github.com/alon710/d0ed93c28f268e6b433624aa592c6856", "content": "# CVE-2026-81192: CVE-2026-81192: Local Code Execution via Untrusted Search Path in OpenTelemetry.Resources.Host\n\n> **CVSS Score:** 7.0\n> **Published:** 2026-09-16\n> **Full Report:** https://cvereports.com/reports/CVE-2026-81192\n\n## Summary\nAn untrusted search path vulnerability (CWE-426) in the OpenTelemetry.Resources.Host NuGet package on macOS allows a local attacker to execute arbitrary code with elevated privileges by hijacking standard system commands such as sh and ioreg.\n\n## TL;DR\nA local PATH hijacking vulnerability in OpenTelemetry's host detector on macOS allows privilege escalation by placing malicious binaries in directories resolved ahead of system paths.\n\n## Technical Details\n\n- **CWE ID**: CWE-426\n- **Attack Vector**: Local (AV:L)\n- **Attack Complexity**: High (AC:H)\n- **Privileges Required**: Low (PR:L)\n- **User Interaction**: None (UI:N)\n- **Scope**: Unchanged (S:U)\n- **EPSS Score**: 0.00138\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- OpenTelemetry.Resources.Host on macOS\n- **OpenTelemetry.Resources.Host**: < 1.16.0-beta.2 (Fixed in: `1.16.0-beta.2`)\n\n## Mitigation\n\n- Upgrade OpenTelemetry.Resources.Host to 1.16.0-beta.2 or later\n- Sanitize and restrict the PATH environment variable\n- Ensure system directories take priority in command resolution\n\n**Remediation Steps:**\n1. Identify references to OpenTelemetry.Resources.Host in project files\n2. Update the NuGet dependency to version 1.16.0-beta.2 or later\n3. Rebuild and redeploy the affected .NET applications\n4. Verify process executions on macOS endpoints using EDR solutions\n\n## References\n\n- [GitHub Security Advisory GHSA-v8pv-4842-x354](https://github.com/open-telemetry/opentelemetry-dotnet-contrib/security/advisories/GHSA-v8pv-4842-x354)\n- [NVD CVE-2026-81192 Details](https://nvd.nist.gov/vuln/detail/CVE-2026-81192)\n- [CVE-2026-81192 Record](https://www.cve.org/CVERecord?id=CVE-2026-81192)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-81192) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-16T15:32:25.887235Z"}