CVE-2026-39883: 
cAdvisor vulnerability analysis and mitigation

CVE-2026-39883 is a PATH hijacking vulnerability in the OpenTelemetry Go SDK (go.opentelemetry.io/otel/sdk) affecting versions >= 1.15.0 and <= 1.42.0. It is an incomplete fix for CVE-2026-24051 (GHSA-9h8m-3fm2-qjrq): while that prior fix updated the Darwin ioreg command to use an absolute path, the BSD kenv command was left using a bare name, leaving BSD and Solaris platforms vulnerable to the same attack. Affected platforms include DragonFly BSD, FreeBSD, NetBSD, OpenBSD, and Solaris. The vulnerability was disclosed on April 8, 2026, and carries a CVSS v4 base score of 7.3 (High) and a CVSS v3.1 base score of 7.0 (High) (GitHub Advisory, OTel Advisory).

The root cause is CWE-426 (Untrusted Search Path): in sdk/resource/host_id.go at line 42, the code calls r.execCommand("kenv", "-q", "smbios.system.uuid") using a bare command name. The execCommand helper (in sdk/resource/host_id_exec.go) uses Go's exec.Command(name, arg...), which searches $PATH when the command name contains no path separator. This code path is triggered during OpenTelemetry resource detection at application startup when /etc/hostid does not exist — a common condition on FreeBSD systems. An attacker with local access can place a malicious binary named kenv earlier in the $PATH environment variable, causing the application to execute it instead of the legitimate /bin/kenv (OTel Advisory, GitHub Advisory).

Successful exploitation allows a local attacker with low privileges to execute arbitrary code in the context of the OpenTelemetry-instrumented application process, resulting in high confidentiality, integrity, and availability impact to the vulnerable system. The attacker can read sensitive data processed by the application, modify application state or data, and potentially crash or disrupt the service. Because the code executes with the application's privileges, the impact is scoped to the vulnerable system without direct lateral movement to subsequent systems, though the compromised process could be leveraged for further attacks depending on the application's role (GitHub Advisory).

No confirmed in-the-wild exploitation has been reported, and no weaponized exploit code is publicly available — the GitHub security advisory provides only root cause analysis and a suggested fix without actionable exploit artifacts (OTel Advisory). The EPSS score is approximately 0.005% (1st percentile), indicating a very low probability of exploitation in the near term (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access and the ability to manipulate the $PATH environment variable, which raises the practical bar for attackers.

1. Gain local access: Obtain a low-privileged local account on a BSD or Solaris system running a Go application that imports go.opentelemetry.io/otel/sdk versions >= 1.15.0 and <= 1.42.0.
2. Verify precondition: Confirm that /etc/hostid does not exist on the target system (common on FreeBSD), which forces the SDK to invoke the kenv command during resource detection.
3. Create malicious binary: Write a malicious executable named kenv (e.g., a reverse shell or command execution payload) and place it in a directory controlled by the attacker (e.g., ~/bin/kenv or /tmp/kenv).
4. Manipulate PATH: Prepend the directory containing the malicious kenv binary to the $PATH environment variable so it appears before /bin (e.g., export PATH=/tmp:$PATH).
5. Trigger resource detection: Wait for or cause the target application to initialize or restart, triggering hostIDReaderBSD.read() which calls exec.Command("kenv", "-q", "smbios.system.uuid") — resolving to the malicious binary.
6. Achieve code execution: The malicious kenv binary executes with the privileges of the OpenTelemetry application process, enabling arbitrary command execution, data exfiltration, or further system compromise (OTel Advisory).

• File System: Presence of an unexpected executable named kenv in non-standard directories (e.g., /tmp/, ~/bin/, or other user-writable directories); file timestamps inconsistent with legitimate system binaries.
• Process: Unusual child processes spawned by the OpenTelemetry-instrumented Go application at startup (e.g., network connections, shell invocations, or unexpected subprocesses originating from the application process).
• Logs: Application logs showing OpenTelemetry resource detection errors or unexpected behavior during startup; OS audit logs (e.g., auditd on supported BSDs) recording execution of kenv from a non-standard path.
• Environment: Evidence of modified $PATH environment variable in process environment listings (e.g., via /proc/<pid>/environ on Linux-compatible BSDs) placing user-writable directories before system directories.

Upgrade go.opentelemetry.io/otel/sdk to version 1.43.0 or later, which fixes the issue by using the absolute path /bin/kenv instead of the bare command name (OTel Release). IBM has also released security updates for affected products including IBM watsonx Orchestrate Developer Edition and IBM Verify Identity Access OIDC Provider (IBM watsonx Advisory, IBM Verify Advisory). As a workaround where immediate patching is not possible, enforce strict $PATH management (e.g., restrict user ability to prepend directories to $PATH) and apply the principle of least privilege to limit local user access on BSD/Solaris systems running affected applications.

The vulnerability was reported by security researcher kodareef5 and remediated by OpenTelemetry maintainer dmathieu in the v1.43.0 release (OTel Advisory). The issue gained attention in the Kubernetes and cloud-native ecosystem, with multiple downstream projects (including kubernetes-sigs/cluster-api, Grafana Mimir, Portainer, DataDog Agent, and CircleCI Server) issuing dependency updates to incorporate the fix. The vulnerability was also noted in the "Last Week in Kubernetes" community newsletter, reflecting broad awareness in the Go/cloud-native community.