CVE-2026-81192: 
C# vulnerability analysis and mitigation

CVE-2026-81192 is an untrusted search path (PATH hijacking) vulnerability in the OpenTelemetry.Resources.Host NuGet package that enables local privilege escalation and arbitrary code execution on macOS. The host.id resource attribute detector invokes the sh and ioreg executables by bare name rather than absolute path, allowing resolution through the attacker-controlled PATH environment variable. All versions of opentelemetry-dotnet-contrib prior to 1.16.0-beta.2 are affected; Linux and Windows hosts are not impacted. The advisory was originally published on July 15, 2026, and the CVE was published to NVD on September 8, 2026. It carries a CVSS v3.1 base score of 7.0 (High) (Github Advisory, GitHub Security Advisory).

The root cause is classified as CWE-426 (Untrusted Search Path). The vulnerability was introduced in PR #1631 (merged April 12, 2024), which implemented host.id detection on macOS by invoking ioreg and sh using bare executable names, causing the OS to resolve them via the PATH environment variable rather than their known system locations (e.g., /usr/sbin/ioreg). A local attacker with lower privileges than the host application can exploit this by placing a malicious binary named ioreg or sh in a directory that appears earlier in PATH than the system directories — for example, by writing to a user-writable directory already present in the application's inherited PATH. The fix, implemented in PR #4760 (merged July 15, 2026), replaces the bare ioreg invocation with its absolute path, eliminating the PATH resolution ambiguity (Github Advisory, Fix PR #4760).

Successful exploitation allows a less-privileged local attacker to execute arbitrary code in the security context of the host application, effectively achieving privilege escalation. All three security dimensions are fully compromised: confidentiality (access to application data and secrets), integrity (ability to modify application behavior or data), and availability (ability to disrupt the application). The impact is scoped to the affected macOS host process and does not directly enable network-based lateral movement, but elevated privileges gained could be leveraged for further local attacks (Github Advisory, GitHub Security Advisory).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Github Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.138% (4th percentile), indicating a low near-term exploitation probability. Exploitation requires local access and the ability to influence the PATH environment variable or write to a directory in the application's search path, raising the attack complexity to High.

1. Identify a target: Confirm the target macOS system runs a .NET application using the OpenTelemetry.Resources.Host NuGet package at a version prior to 1.16.0-beta.2 and that the application process runs with higher privileges than the attacker's account.
2. Identify a writable PATH directory: Enumerate the PATH environment variable inherited by the target application process (e.g., via /proc-equivalent inspection or by observing the process environment) to find a directory that appears before /usr/sbin and is writable by the attacker.
3. Create a malicious binary: Craft a malicious executable named ioreg (or sh) that performs the desired payload — such as spawning a reverse shell, adding a backdoor user, or exfiltrating credentials — and ensure it is executable (chmod +x).
4. Place the binary: Copy the malicious ioreg binary into the writable directory identified in step 2, ensuring it precedes /usr/sbin in the PATH order.
5. Trigger execution: Wait for or trigger the application to initialize or refresh its OpenTelemetry host resource detector (e.g., application startup or resource re-detection), which causes the vulnerable code to invoke ioreg by bare name, resolving to the attacker's binary.
6. Achieve privilege escalation: The malicious binary executes in the application's security context, granting the attacker elevated privileges on the macOS host (Github Advisory, GitHub Security Advisory).

• File System: Presence of an executable named ioreg or sh in a non-standard directory (i.e., outside /usr/sbin, /bin, /usr/bin) that appears in the application process's PATH; unexpected modification timestamps on directories listed in the application's PATH.
• Process: Unusual child processes spawned by the .NET application host process (e.g., unexpected shells, network tools like curl or nc, or unknown binaries); ioreg-named processes running from paths other than /usr/sbin/ioreg.
• Logs: macOS Unified Log (log show) entries showing process execution of ioreg from an unexpected path; audit log entries (/var/audit) recording privilege changes or unexpected file access by the application process.
• Network: Unexpected outbound connections from the application process to external IPs, which may indicate a reverse shell payload was executed.

Upgrade the OpenTelemetry.Resources.Host NuGet package to version 1.16.0-beta.2 or later, which fixes the vulnerability by invoking ioreg using its absolute path (/usr/sbin/ioreg) (Github Advisory, Fix PR #4760). No configuration-based workarounds are available. As a defense-in-depth measure, ensure that applications running on macOS do not inherit user-writable directories in their PATH, and apply the principle of least privilege to limit local user access on macOS hosts running this package.