Is CVE-2026-39883 actively exploited?

No active exploitation of CVE-2026-39883 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-39883 be exploited remotely?

No. CVE-2026-39883 requires local access to exploit.

What is the CVSS score of CVE-2026-39883?

CVE-2026-39883 has a CVSS score of 7.0 (HIGH).

HOME VULNERABILITIESCVE-2026-39883

HIGH

CVE-2026-39883

CWE-426Published: April 8, 2026· Updated: Apr 10, 2026

7.0

CVSS v3.1

EPSS:0.01%probability of exploitation in 30 daysPercentile:0.3th

Official Description

OpenTelemetry-Go is the Go implementation of OpenTelemetry. From 1.15.0 to 1.42.0, the fix for CVE-2026-24051 changed the Darwin ioreg command to use an absolute path but left the BSD kenv command using a bare name, allowing the same PATH hijacking attack on BSD and Solaris platforms. This vulnerability is fixed in 1.43.0.

NVD Source

Technical Analysis

CVE-2026-39883 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 7.0.