Executive brief
OpenTelemetry.Resources.Host is a .NET library component that detects host system information for observability applications. On macOS, the library launches system tools using bare executable names rather than full paths, allowing a less-privileged local attacker to hijack the search path and execute arbitrary code with the privileges of the vulnerable application—potentially escalating from a low-privileged process to a high-privileged service.
Technical details
This vulnerability is an untrusted search path flaw (CWE-426) affecting the macOS implementation of the OpenTelemetry.Resources.Host NuGet package versions before 1.16.0-beta.2. The host.id resource attribute detector invokes `ioreg` and `sh` by their bare names, causing them to be resolved through the PATH environment variable. An attacker with lower privileges than the vulnerable application—such as a regular user against a privileged service—can write a malicious `ioreg` executable to a directory they control or prepend to PATH, achieving code execution in the application's context. The attack requires the ability to influence PATH or write to a PATH directory that precedes system directories; no user interaction is required. The vulnerability was patched in version 1.16.0-beta.2 by modifying the code to use absolute paths for executable invocation. Linux and Windows hosts are unaffected.
Affected products
- OpenTelemetry OpenTelemetry.Resources.Host < 1.16.0-beta.2
Timeline
- 2026-07-15: disclosed
- 2026-09-16: patched: Version 1.16.0-beta.2 released
- 2026-09-16: advisory: Published to GitHub Advisory Database
References
- https://api.github.com/users/martincostello
- https://github.com/martincostello
- https://api.github.com/users/martincostello/gists%7B/gist_id%7D
- https://api.github.com/users/martincostello/repos
- https://avatars.githubusercontent.com/u/1439341?v=4
- https://api.github.com/users/martincostello/events%7B/privacy%7D