CVE-2026-81192 describes an untrusted search path vulnerability (CWE-426) in the OpenTelemetry.Resources.Host NuGet package used by opentelemetry-dotnet-contrib on macOS. The host.id resource attribute detector executes 'sh' and 'ioreg' by bare name rather than absolute path, causing these executables to be resolved via the PATH environment variable. A local attacker with lower privileges who can influence PATH or write to a directory that appears earlier in PATH can cause arbitrary binaries to be executed in the application's security context, leading to local code execution or privilege escalation. This issue is specific to macOS; Linux and Windows hosts are not affected. The vulnerability is fixed in version 1.16.0-beta.2.

Successful exploitation allows a local attacker with limited privileges to execute arbitrary code with the security context of the affected application, potentially leading to privilege escalation on macOS systems running vulnerable versions of opentelemetry-dotnet-contrib. Confidentiality, integrity, and availability impacts are rated high per the CVSS vector.

Version 1.16.0-beta.2 contains a patch that fixes this vulnerability by presumably using absolute paths for executable calls. Users should upgrade to at least version 1.16.0-beta.2 to remediate this issue. No known workarounds are available. Since this is not a cloud service, remediation depends on updating the affected software.