EUVD-2026-74187Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Local-only attack surface with PATH control required (AV:L/AC:H), low-privilege local account needed (PR:L), and full application-context compromise achievable (C:H/I:H/A:H).
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
6DescriptionCVE.org
OpenTelemetry.Resources.Host NuGet package, which provides OpenTelemetry resource detectors for host, is affected by an untrusted search path vulnerability on macOS. Prior to version 1.16.0-beta.2, the host.id resource attribute detector launches the sh and ioreg executables by bare name rather than by absolute path, so both are resolved through the PATH environment variable. A local attacker who is less privileged than the host application, and who can influence PATH or write to a directory that appears in PATH ahead of the system directories, can have an arbitrary binary executed in the application's security context, resulting in local code execution/privilege escalation. This vulnerability only affect macOS hosts - Linux and Windows hosts are unaffected. Version 1.16.0-beta.2 contains a patch. No known workarounds are available.
AnalysisAI
Privilege escalation and local code execution affect the OpenTelemetry.Resources.Host NuGet package (opentelemetry-dotnet-contrib) on macOS prior to version 1.16.0-beta.2. The host.id resource attribute detector invokes sh and ioreg using bare names resolved through the PATH environment variable rather than absolute paths, allowing a local attacker with fewer privileges than the host application to substitute malicious binaries and execute arbitrary code in the application's security context. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | All four of the following conditions must be met simultaneously: (1) the target host runs macOS - Linux and Windows are explicitly unaffected; (2) the OpenTelemetry.Resources.Host NuGet package at a version prior to 1.16.0-beta.2 is loaded and the host.id resource attribute detector is active in the running application; (3) the attacker holds a local macOS user account with fewer privileges than the application process; (4) the attacker can either prepend a directory under their control to the PATH environment variable as seen by the application process, or write a file into a directory that already appears in PATH before /bin. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H (score 7.0) accurately represents this as a locally-exploited, high-complexity flaw requiring an authenticated low-privilege account - it carries no remote attack surface. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to OpenTelemetry.Resources.Host version 1.16.0-beta.2 or later, which resolves the untrusted search path by using absolute executable paths for sh and ioreg invocations. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all .NET applications and services using opentelemetry-dotnet-contrib on macOS systems by reviewing dependency manifests for OpenTelemetry.Resources.Host packages. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-426 – Untrusted Search Path
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today