Skip to content

fix(deps): Update module go.opentelemetry.io/otel/sdk to v1.43.0 [SECURITY]#6018

Open
renovate-sh-app[bot] wants to merge 1 commit intomainfrom
renovate/go-go.opentelemetry.io-otel-sdk-vulnerability
Open

fix(deps): Update module go.opentelemetry.io/otel/sdk to v1.43.0 [SECURITY]#6018
renovate-sh-app[bot] wants to merge 1 commit intomainfrom
renovate/go-go.opentelemetry.io-otel-sdk-vulnerability

Conversation

@renovate-sh-app
Copy link
Copy Markdown
Contributor

@renovate-sh-app renovate-sh-app bot commented Apr 8, 2026 •
edited
Loading

This PR contains the following updates:

Package Change Age Confidence
go.opentelemetry.io/otel/sdk v1.42.0 → v1.43.0 age confidence

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

GitHub Vulnerability Alerts

CVE-2026-39883

Summary

The fix for GHSA-9h8m-3fm2-qjrq (CVE-2026-24051) changed the Darwin ioreg command to use an absolute path but left the BSD kenv command using a bare name, allowing the same PATH hijacking attack on BSD and Solaris platforms.

Root Cause

sdk/resource/host_id.go line 42:

if result, err := r.execCommand("kenv", "-q", "smbios.system.uuid"); err == nil {

Compare with the fixed Darwin path at line 58:

result, err := r.execCommand("/usr/sbin/ioreg", "-rd1", "-c", "IOPlatformExpertDevice")

The execCommand helper at sdk/resource/host_id_exec.go uses exec.Command(name, arg...) which searches $PATH when the command name contains no path separator.

Affected platforms (per build tag in host_id_bsd.go:4): DragonFly BSD, FreeBSD, NetBSD, OpenBSD, Solaris.

The kenv path is reached when /etc/hostid does not exist (line 38-40), which is common on FreeBSD systems.

Attack

  1. Attacker has local access to a system running a Go application that imports go.opentelemetry.io/otel/sdk
  2. Attacker places a malicious kenv binary earlier in $PATH
  3. Application initializes OpenTelemetry resource detection at startup
  4. hostIDReaderBSD.read() calls exec.Command("kenv", ...) which resolves to the malicious binary
  5. Arbitrary code executes in the context of the application

Same attack vector and impact as CVE-2026-24051.

Suggested Fix

Use the absolute path:

if result, err := r.execCommand("/bin/kenv", "-q", "smbios.system.uuid"); err == nil {

On FreeBSD, kenv is located at /bin/kenv.

opentelemetry-go: BSD kenv command not using absolute path enables PATH hijacking

CVE-2026-39883 / GHSA-hfvc-g4fc-pqhx

More information

Details

Summary

The fix for GHSA-9h8m-3fm2-qjrq (CVE-2026-24051) changed the Darwin ioreg command to use an absolute path but left the BSD kenv command using a bare name, allowing the same PATH hijacking attack on BSD and Solaris platforms.

Root Cause

sdk/resource/host_id.go line 42:

if result, err := r.execCommand("kenv", "-q", "smbios.system.uuid"); err == nil {

Compare with the fixed Darwin path at line 58:

result, err := r.execCommand("/usr/sbin/ioreg", "-rd1", "-c", "IOPlatformExpertDevice")

The execCommand helper at sdk/resource/host_id_exec.go uses exec.Command(name, arg...) which searches $PATH when the command name contains no path separator.

Affected platforms (per build tag in host_id_bsd.go:4): DragonFly BSD, FreeBSD, NetBSD, OpenBSD, Solaris.

The kenv path is reached when /etc/hostid does not exist (line 38-40), which is common on FreeBSD systems.

Attack
  1. Attacker has local access to a system running a Go application that imports go.opentelemetry.io/otel/sdk
  2. Attacker places a malicious kenv binary earlier in $PATH
  3. Application initializes OpenTelemetry resource detection at startup
  4. hostIDReaderBSD.read() calls exec.Command("kenv", ...) which resolves to the malicious binary
  5. Arbitrary code executes in the context of the application

Same attack vector and impact as CVE-2026-24051.

Suggested Fix

Use the absolute path:

if result, err := r.execCommand("/bin/kenv", "-q", "smbios.system.uuid"); err == nil {

On FreeBSD, kenv is located at /bin/kenv.

Severity

  • CVSS Score: 7.3 / 10 (High)
  • Vector String: CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Release Notes

open-telemetry/opentelemetry-go (go.opentelemetry.io/otel/sdk)

v1.43.0: /v0.65.0/v0.19.0

Compare Source

Added
  • Add IsRandom and WithRandom on TraceFlags, and IsRandom on SpanContext in go.opentelemetry.io/otel/trace
    for W3C Trace Context Level 2 Random Trace ID Flag support. (#​8012)
  • Add service detection with WithService in go.opentelemetry.io/otel/sdk/resource. (#​7642)
  • Add DefaultWithContext and EnvironmentWithContext in go.opentelemetry.io/otel/sdk/resource to support plumbing context.Context through default and environment detectors. (#​8051)
  • Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc. (#​8038)
  • Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc. (#​8038)
  • Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc. (#​8038)
  • Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp. (#​8038)
  • Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp. (#​8038)
  • Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#​8038)
  • Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/sdk/metric/metricdata/metricdatatest. (#​8038)
  • Add support for per-series start time tracking for cumulative metrics in go.opentelemetry.io/otel/sdk/metric.
    Set OTEL_GO_X_PER_SERIES_START_TIMESTAMPS=true to enable. (#​8060)
  • Add WithCardinalityLimitSelector for metric reader for configuring cardinality limits specific to the instrument kind. (#​7855)
Changed
  • Introduce the EMPTY Type in go.opentelemetry.io/otel/attribute to reflect that an empty value is now a valid value, with INVALID remaining as a deprecated alias of EMPTY. (#​8038)
  • Refactor slice handling in go.opentelemetry.io/otel/attribute to optimize short slice values with fixed-size fast paths. (#​8039)
  • Improve performance of span metric recording in go.opentelemetry.io/otel/sdk/trace by returning early if self-observability is not enabled. (#​8067)
  • Improve formatting of metric data diffs in go.opentelemetry.io/otel/sdk/metric/metricdata/metricdatatest. (#​8073)
Deprecated
  • Deprecate INVALID in go.opentelemetry.io/otel/attribute. Use EMPTY instead. (#​8038)
Fixed
  • Return spec-compliant TraceIdRatioBased description. This is a breaking behavioral change, but it is necessary to
    make the implementation spec-compliant. (#​8027)
  • Fix a race condition in go.opentelemetry.io/otel/sdk/metric where the lastvalue aggregation could collect the value 0 even when no zero-value measurements were recorded. (#​8056)
  • Limit HTTP response body to 4 MiB in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp to mitigate excessive memory usage caused by a misconfigured or malicious server.
    Responses exceeding the limit are treated as non-retryable errors. (#​8108)
  • Limit HTTP response body to 4 MiB in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp to mitigate excessive memory usage caused by a misconfigured or malicious server.
    Responses exceeding the limit are treated as non-retryable errors. (#​8108)
  • Limit HTTP response body to 4 MiB in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp to mitigate excessive memory usage caused by a misconfigured or malicious server.
    Responses exceeding the limit are treated as non-retryable errors. (#​8108)
  • WithHostID detector in go.opentelemetry.io/otel/sdk/resource to use full path for kenv command on BSD. (#​8113)
  • Fix missing request.GetBody in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp to correctly handle HTTP2 GOAWAY frame. (#​8096)
What's Changed
New Contributors

Full Changelog: open-telemetry/opentelemetry-go@v1.42.0...v1.43.0

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

  • If you want to rebase/retry this PR, check this box

Need help?

You can ask for more help in the following Slack channel: #proj-renovate-self-hosted. In that channel you can also find ADR and FAQ docs in the Resources section.

@renovate-sh-app renovate-sh-app bot requested a review from a team as a code owner April 8, 2026 19:50
@renovate-sh-app renovate-sh-app bot enabled auto-merge (squash) April 8, 2026 19:50
@renovate-sh-app
Copy link
Copy Markdown
Contributor Author

renovate-sh-app bot commented Apr 8, 2026

ℹ️ Artifact update notice

File name: collector/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 4 additional dependencies were updated

Details:

Package Change
go.opentelemetry.io/otel v1.42.0 -> v1.43.0
go.opentelemetry.io/otel/metric v1.42.0 -> v1.43.0
go.opentelemetry.io/otel/sdk/metric v1.42.0 -> v1.43.0
go.opentelemetry.io/otel/trace v1.42.0 -> v1.43.0
File name: extension/alloyengine/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 4 additional dependencies were updated

Details:

Package Change
go.opentelemetry.io/otel v1.42.0 -> v1.43.0
go.opentelemetry.io/otel/metric v1.42.0 -> v1.43.0
go.opentelemetry.io/otel/sdk/metric v1.42.0 -> v1.43.0
go.opentelemetry.io/otel/trace v1.42.0 -> v1.43.0
File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 4 additional dependencies were updated

Details:

Package Change
go.opentelemetry.io/otel v1.42.0 -> v1.43.0
go.opentelemetry.io/otel/metric v1.42.0 -> v1.43.0
go.opentelemetry.io/otel/sdk/metric v1.42.0 -> v1.43.0
go.opentelemetry.io/otel/trace v1.42.0 -> v1.43.0

@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Apr 8, 2026 •
edited
Loading

🔍 Dependency Review

Below are the dependency updates detected in go.mod files across the repo (root, collector/, extension/alloyengine/), along with an assessment of code impact and any required changes.

Note: All of these updates are within the stable v1 line of OpenTelemetry-Go. Per the OpenTelemetry-Go stability guarantees, modules at v1 follow Semantic Versioning and do not introduce breaking API changes in minor releases. This implies existing code using v1.42.0 should continue to compile and run on v1.43.0 without code changes.

go.opentelemetry.io/otel 1.42.0 -> 1.43.0 — ✅ Safe

Scope

  • Updated in: root go.mod (direct), collector/go.mod (indirect), extension/alloyengine/go.mod (indirect)

Impact

  • No breaking API changes expected between v1.42.0 and v1.43.0 for this stable module.
  • Existing telemetry setup, context propagation, baggage, and trace/metric API usage should continue to work unchanged.

Evidence

  • OpenTelemetry-Go stability guarantee: stable v1 modules adhere to Semantic Versioning; minor updates do not break public APIs.

Required code changes

  • None.

Compatibility notes

  • Your exporters remain at v1.42.0. OpenTelemetry-Go modules are designed to be cross-minor compatible within v1, so mixing v1.43 core with v1.42 exporters is supported.

Suggested actions

  • Rebuild and run tests to confirm behavior parity.
go.opentelemetry.io/otel/metric 1.42.0 -> 1.43.0 — ✅ Safe

Scope

  • Updated in: root go.mod (direct), collector/go.mod (indirect), extension/alloyengine/go.mod (indirect)

Impact

  • No API changes required for MeterProvider/Meter usage, instrument creation (Counter/Histogram/UpDownCounter), or attribute handling.

Evidence

  • Module is v1-stable; minor bumps are backward compatible per OpenTelemetry-Go stability guarantees.

Required code changes

  • None.

Suggested actions

  • Rebuild and run any metric-focused tests/dashboards to verify expected timeseries continuity.
go.opentelemetry.io/otel/sdk 1.42.0 -> 1.43.0 — ✅ Safe

Scope

  • Updated in: root go.mod (direct), collector/go.mod (indirect), extension/alloyengine/go.mod (indirect)

Impact

  • No changes required for TracerProvider/Resource/SpanProcessor configuration or environment variable behavior.

Evidence

  • v1-stable SDK minor updates do not break public APIs.

Required code changes

  • None.

Compatibility notes

  • Exporters pinned at v1.42.0 remain compatible with SDK v1.43.0 within v1.
go.opentelemetry.io/otel/sdk/metric 1.42.0 -> 1.43.0 — ✅ Safe

Scope

  • Updated in: root go.mod (direct), collector/go.mod (indirect), extension/alloyengine/go.mod (indirect)

Impact

  • No code changes needed for View/Reader/Temporality/Aggregation configuration or controller setup.

Evidence

  • v1-stable, minor update; no breaking API surface changes per OTel-Go stability guarantees.

Required code changes

  • None.

Suggested actions

  • If you have golden tests for metric output formats, run them to confirm no behavioral drift.
go.opentelemetry.io/otel/trace 1.42.0 -> 1.43.0 — ✅ Safe

Scope

  • Updated in: root go.mod (direct), collector/go.mod (indirect), extension/alloyengine/go.mod (indirect)

Impact

  • No changes required for span creation, attributes/events/links, or context propagation.

Evidence

  • v1-stable package with minor version bump; backward compatible per OpenTelemetry-Go stability guarantees.

Required code changes

  • None.

Notes

  • Exporter modules remain on v1.42.0. This is acceptable and supported with v1.43.0 core/SDK modules.
  • After merging, run go mod tidy, rebuild, and execute the test suite and any telemetry integration checks to validate end-to-end behavior.

@renovate-sh-app renovate-sh-app bot force-pushed the renovate/go-go.opentelemetry.io-otel-sdk-vulnerability branch from b01eb72 to 40ff6e3 Compare April 8, 2026 21:14
@renovate-sh-app renovate-sh-app bot force-pushed the renovate/go-go.opentelemetry.io-otel-sdk-vulnerability branch 6 times, most recently from 4ef72e1 to 20d6678 Compare April 10, 2026 15:17
@renovate-sh-app
fix(deps): Update module go.opentelemetry.io/otel/sdk to v1.43.0 [SEC…
036c5b1 
…URITY]

| datasource | package                      | from    | to      |
| ---------- | ---------------------------- | ------- | ------- |
| go         | go.opentelemetry.io/otel/sdk | v1.42.0 | v1.43.0 |


Signed-off-by: renovate-sh-app[bot] <219655108+renovate-sh-app[bot]@users.noreply.github.com>
@renovate-sh-app renovate-sh-app bot force-pushed the renovate/go-go.opentelemetry.io-otel-sdk-vulnerability branch from 20d6678 to 036c5b1 Compare April 13, 2026 09:17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

automerge-security-update severity:HIGH update-minor

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants