CVE catalog

CVE-2026-39883

Severity: High · CVSS 8.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Published: Apr 8, 2026, 8:26:41 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.25% · Oct 25, 2026

OpenTelemetry-Go is the Go implementation of OpenTelemetry. From 1.15.0 to 1.42.0, the fix for CVE-2026-24051 changed the Darwin ioreg command to use an absolute path but left the BSD kenv command using a bare name, allowing the same PATH hijacking attack on BSD and Solaris platforms. This vulnerability is fixed in 1.43.0.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	golang-opentelemetry-otel	sid	`1.46.0-3`	not affected
Debian	golang-opentelemetry-otel	forky	`1.46.0-2`	not affected
Debian	golang-opentelemetry-otel	trixie	`1.31.0-4`	not affected
Debian	golang-opentelemetry-otel	bookworm	`1.1.0-2`	not affected
Cpe	opentelemetry	Not reported	`1.43.0`	fixed
Go	go.opentelemetry.io/otel/sdk	Not reported	`1.43.0`	fixed
Cpe	opentelemetry	Not reported	`1.43.0`	fixed
Opensuse	clusterctl	tumbleweed	`1.14.0-1.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	golang-opentelemetry-otel	source	sid	`Not affected`	unimportant	Not reported	Not reported
Debian	golang-opentelemetry-otel	source	forky	`Not affected`	unimportant	Not reported	Not reported
Debian	golang-opentelemetry-otel	source	trixie	`Not affected`	unimportant	Not reported	Not reported
Debian	golang-opentelemetry-otel	source	bookworm	`Not affected`	unimportant	Not reported	Not reported
Cpe	opentelemetry	cpe	Not reported	`1.43.0`	Not reported	Not reported	Not reported
Go	go.opentelemetry.io/otel/sdk	Go	Not reported	`1.43.0`	Not reported	Not reported	Not reported
Cpe	opentelemetry	cpe	Not reported	`1.43.0`	Not reported	NVD-CVE-2026-39883	Not reported
Opensuse	clusterctl	rpm	tumbleweed	`1.14.0-1.1`	Not reported	OPENSUSE-SU-2026:11494-1	Not reported

OpenFactory catalog packages

[openSUSE Tumbleweed]

[clusterctl-bash-completion]Unknown
Source package: [clusterctl]
Details (1)
- 1.14.0-1.1 · noarch · tumbleweed
  Unknown · Fixed: 1.14.0-1.1
  Version impact unknown
  nvd · clusterctl · opensuse · tumbleweed
[clusterctl-fish-completion]Unknown
Source package: [clusterctl]
Details (1)
- 1.14.0-1.1 · noarch · tumbleweed
  Unknown · Fixed: 1.14.0-1.1
  Version impact unknown
  nvd · clusterctl · opensuse · tumbleweed
[clusterctl-zsh-completion]Unknown
Source package: [clusterctl]
Details (1)
- 1.14.0-1.1 · noarch · tumbleweed
  Unknown · Fixed: 1.14.0-1.1
  Version impact unknown
  nvd · clusterctl · opensuse · tumbleweed
[clusterctl]Fixed
Source package: [clusterctl]
Details (1)
- 1.14.0-1.1 · x86_64 · tumbleweed
  Fixed · Fixed: 1.14.0-1.1
  nvd · clusterctl · opensuse · tumbleweed

[Debian 12 (Bookworm)]

[golang-opentelemetry-otel-dev]Not affected
Source package: [golang-opentelemetry-otel]
Details (2)
- 1.1.0-2 · all · bookworm
  Not affected
  nvd · golang-opentelemetry-otel · debian · bookworm
- 1.1.0-2 · all · bookworm
  Not affected
  nvd · golang-opentelemetry-otel · debian · bookworm

Observed: Oct 23, 2026, 10:34:53 PM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [Go Vulnerability Database] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]