The open-telemetry opentelemetry-go library versions 1.15.0 through 1.42.0 contain an untrusted search path vulnerability (CWE-426) due to the use of a bare command name for the BSD kenv command instead of an absolute path. This allows an attacker with local privileges to potentially hijack the PATH environment variable and execute malicious code by placing a crafted executable earlier in the search path. The issue affects BSD and Solaris platforms. The vulnerability was introduced as a regression when fixing CVE-2026-24051, which had addressed a similar issue for the Darwin ioreg command by switching to an absolute path. The vulnerability is resolved in opentelemetry-go version 1.43.0.

An attacker with local access and low privileges on BSD or Solaris systems could exploit this vulnerability to execute arbitrary code by manipulating the PATH environment variable to hijack the kenv command execution. This could lead to elevated impact on confidentiality, integrity, and availability of the affected system. There are no reports of active exploitation in the wild.

Upgrade opentelemetry-go to version 1.43.0 or later, where this vulnerability is fixed by using an absolute path for the kenv command. Since this is a code-level fix, applying the official update is the recommended remediation. Patch status is confirmed fixed in version 1.43.0.