OpenTelemetry-Go is the Go implementation of OpenTelemetry. From 1.15.0 to 1.42.0, the fix for CVE-2026-24051 changed the Darwin ioreg command to use an absolute path but left the BSD kenv command using a bare name, allowing the same PATH hijacking attack on BSD and Solaris platforms. This vulnerability is fixed in 1.43.0.

An update of the docker package has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - OpenTelemetry-Go is the Go implementation of OpenTelemetry. From 1.15.0 to 1.42.0, the fix for     CVE-2026-24051 changed the Darwin ioreg command to use an absolute path but left the BSD kenv command     using a bare name, allowing the same PATH hijacking attack on BSD and Solaris platforms. This     vulnerability is fixed in 1.43.0. (CVE-2026-39883)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - OpenTelemetry-Go is the Go implementation of OpenTelemetry. From 1.15.0 to 1.42.0, the fix for
    CVE-2026-24051 changed the Darwin ioreg command to use an absolute path but left the BSD kenv command
    using a bare name, allowing the same PATH hijacking attack on BSD and Solaris platforms. This
    vulnerability is fixed in 1.43.0. (CVE-2026-39883)

ID	Name	Product	Family	Severity
322364	Photon OS 5.0: Docker PHSA-2026-5.0-0869	Nessus	PhotonOS Local Security Checks	high
306146	Linux Distros Unpatched Vulnerability : CVE-2026-39883	Nessus	Misc.	high
440042	SCA: security update for go.opentelemetry.io/otel/sdk (GHSA-hfvc-g4fc-pqhx)	Tenable Cloud Security	SCA Checks	high
440042	SCA: security update for go.opentelemetry.io/otel/sdk (GHSA-hfvc-g4fc-pqhx)	Tenable Self-Hosted Container Security	SCA Checks	high

Detections

Analytics

CVE-2026-39883

high

Tenable Plugins

high

high

high

high