CVE-2026-81192

The OpenTelemetry.Resources.Host NuGet package, which provides host resource detectors for OpenTelemetry .NET, launches the `sh` and `ioreg` executables by bare name when computing the `host.id` resource attribute, so on macOS both are resolved through the PATH environment variable instead of by absolute path. A local attacker who is less privileged than the host application and can influence PATH, or write to a directory that appears ahead of the system directories in PATH, can have an arbitrary binary executed in the application's security context, gaining local code execution and potentially privilege escalation. Only macOS hosts are affected; Linux and Windows deployments of the package are unaffected. All versions prior to 1.16.0-beta.2 are vulnerable, and version 1.16.0-beta.2 contains the patch. No exploitation is currently known: EPSS estimates about a 0.1% probability of exploitation within 30 days, the issue is not in CISA KEV, and no public proof-of-concept exists.

What to do: Upgrade OpenTelemetry.Resources.Host to version 1.16.0-beta.2 or later on any macOS hosts running instrumented .NET applications; no workarounds are available. Until patched, check whether any macOS applications embedding this detector run with a PATH that less-privileged local users can influence (e.g., writable directories ahead of the system directories) and treat those as the highest-risk deployments. Linux and Windows hosts require no action.