7.3
High
CVE-2026-39883 OpenTelemetry-Go is the Go implementation of OpenTelemetry
Description
OpenTelemetry-Go is the Go implementation of OpenTelemetry. From 1.15.0 to 1.42.0, the fix for CVE-2026-24051 changed the Darwin ioreg command to use an absolute path but left the BSD kenv command using a bare name, allowing the same PATH hijacking attack on BSD and Solaris platforms. This vulnerability is fixed in 1.43.0.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| opentelemetry-go 1.15 | 1.15.0 → < 1.43.0 | 1.43.0 |
| multicluster engine for Kubernetes 2.8 1781539725 | earliest → < 1781539725 | 1781539725 |
| Red Hat Openshift Data Foundation 4.22 1782934284 | earliest → < 1782934284 | 1782934284 |
| Fence Agents Remediation Operator | Versions not published | |
| Storage-Based Remediation | Versions not published | |
| Red Hat OpenShift Workload Availability 0.3 1785203474 | earliest → < 1785203474 | 1785203474 |
| Red Hat OpenShift Workload Availability 0.8 1785203079 | earliest → < 1785203079 | 1785203079 |
| Cert Manager support for Red Hat OpenShift release 1.19 1788348594 | earliest → < 1788348594 | 1788348594 |
References
- github.com github.com
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of opentelemetry-go
The 9 CVEs of opentelemetry-go →
CVE-2026-81871
OpenTelemetry-Go is the Go implementation of OpenTelemetry
6.3
Medium
CVE-2026-81872
OpenTelemetry-Go is the Go implementation of OpenTelemetry
6.3
Medium
CVE-2026-81869
OpenTelemetry-Go is the Go implementation of OpenTelemetry
5.1
Medium
CVE-2026-81870
OpenTelemetry-Go is the Go implementation of OpenTelemetry
2.0
Low