CVE-2026-39883

CVE-2026-39883 is a PATH hijacking vulnerability affecting OpenTelemetry-Go versions 1.15.0 through 1.42.0. The vulnerability stems from an incomplete fix to CVE-2026-24051, where the BSD kenv command continues to use a bare executable name rather than an absolute path, enabling local attackers to conduct privilege escalation attacks on BSD and Solaris platforms. The issue was resolved in version 1.43.0. The vulnerability carries a CVSS severity rating of 7.0 (HIGH) with a local attack vector requiring low privileges and high attack complexity. Successful exploitation could result in high-impact consequences across confidentiality, integrity, and authenticity, allowing attackers to execute arbitrary code with elevated privileges through PATH manipulation tactics. There is currently no evidence of active exploitation in the wild, with the vulnerability absent from the National Vulnerability Database's Known Exploited Vulnerabilities catalog. The EPSS score of 0.00008 indicates minimal likelihood of exploitation compared to other CVEs, suggesting low community attention and no publicly available exploit code at this time.