Skip to content

[Cycode] Fix for vulnerable manifest file dependency - go.opentelemetry.io/otel/sdk updated to version 1.33.0 #19

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
cycode-security wants to merge 1 commit into
base: master
Choose a base branch
from
+1 −1
Open

[Cycode] Fix for vulnerable manifest file dependency - go.opentelemetry.io/otel/sdk updated to version 1.33.0 #19

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@
go.opentelemetry.io/collector/exporter v0.111.0
go.opentelemetry.io/collector/pdata v1.17.0
go.opentelemetry.io/otel/metric v1.30.0
go.opentelemetry.io/otel/sdk v1.30.0
go.opentelemetry.io/otel/sdk v1.33.0

Check failure on line 21 in go.mod

View check run for this annotation

Cycode Security / Cycode: Vulnerable Dependencies

go.mod#L21 

Vulnerability found in dependency found

Check failure on line 21 in go.mod

View check run for this annotation

Cycode Security / Cycode: Vulnerable Dependencies

go.mod#L21 

Vulnerability found in dependency found

@cycode-security cycode-security Bot Sep 29, 2026

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

❗Cycode: Security vulnerability found in newly introduced dependency.
Risk Score 77 (HIGH)
Severity High
Issue opentelemetry-go: BSD kenv command not using absolute path enables PATH hijacking: CVE-2026-39883
Ecosystem Go
Dependency go.opentelemetry.io/otel/sdk
Dependency Paths go.opentelemetry.io/otel/sdk 1.33.0
Direct Dependency Yes
Development Dependency No
Upgrade 1.43.0

Summary

The fix for GHSA-9h8m-3fm2-qjrq (CVE-2026-24051) changed the Darwin ioreg command to use an absolute path but left the BSD kenv command using a bare name, allowing the same PATH hijacking attack on BSD and Solaris platforms.

Root Cause

sdk/resource/host_id.go line 42:

if result, err := r.execCommand("kenv", "-q", "smbios.system.uuid"); err == nil {

Compare with the fixed Darwin path at line 58:

result, err := r.execCommand("/usr/sbin/ioreg", "-rd1", "-c", "IOPlatformExpertDevice")

The execCommand helper at sdk/resource/host_id_exec.go uses exec.Command(name, arg...) which searches $PATH when the command name contains no path separator.

Affected platforms (per build tag in host_id_bsd.go:4): DragonFly BSD, FreeBSD, NetBSD, OpenBSD, Solaris.

The kenv path is reached when /etc/hostid does not exist (line 38-40), which is common on FreeBSD systems.

Attack

  1. Attacker has local access to a system running a Go application that imports go.opentelemetry.io/otel/sdk
  2. Attacker places a malicious kenv binary earlier in $PATH
  3. Application initializes OpenTelemetry resource detection at startup
  4. hostIDReaderBSD.read() calls exec.Command("kenv", ...) which resolves to the malicious binary
  5. Arbitrary code executes in the context of the application

Same attack vector and impact as CVE-2026-24051.

Suggested Fix

Use the absolute path:

if result, err := r.execCommand("/bin/kenv", "-q", "smbios.system.uuid"); err == nil {

On FreeBSD, kenv is located at /bin/kenv.

Description

Detects when new vulnerabilities affect your dependencies.

Tell us how you wish to proceed using one of the following commands:

Tag Short Description
#cycode_ignore_manifest_here <reason> Applies to this manifest in this request only
#cycode_vulnerable_package_fix_this_violation Fix this violation via a commit to this branch
#cycode_ignore_package_here <reason> Applies to this manifest for this package in this request only

⚠️ When commenting on Github, you may need to refresh the page to see the latest updates.

@cycode-security cycode-security Bot Sep 29, 2026

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

❗Cycode: Security vulnerability found in newly introduced dependency.
Risk Score 77 (HIGH)
Severity High
Issue OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution via PATH Hijacking: CVE-2026-24051
Ecosystem Go
Dependency go.opentelemetry.io/otel/sdk
Dependency Paths go.opentelemetry.io/otel/sdk 1.33.0
Direct Dependency Yes
Development Dependency No
Upgrade 1.40.0

Impact

The OpenTelemetry Go SDK in version v1.20.0-1.39.0 is vulnerable to Path Hijacking (Untrusted Search Paths) on macOS/Darwin systems. The resource detection code in sdk/resource/host_id.go executes the ioreg system command using a search path. An attacker with the ability to locally modify the PATH environment variable can achieve Arbitrary Code Execution (ACE) within the context of the application.

Patches

This has been patched in d45961b, which was released with v1.40.0.

References

Description

Detects when new vulnerabilities affect your dependencies.

Tell us how you wish to proceed using one of the following commands:

Tag Short Description
#cycode_ignore_manifest_here <reason> Applies to this manifest in this request only
#cycode_vulnerable_package_fix_this_violation Fix this violation via a commit to this branch
#cycode_ignore_package_here <reason> Applies to this manifest for this package in this request only

⚠️ When commenting on Github, you may need to refresh the page to see the latest updates.

go.opentelemetry.io/proto/otlp v1.3.1
go.uber.org/zap v1.27.0
)
Expand Down
Loading