CVE-2026-24051: OpenTelemetry-Go Affected by Arbitrary Code Execution via PATH Hijacking

Analyzed

AliasesCGA-2237-9wcx-qq5gCGA-22v3-jgq6-qp9jCGA-23cm-4vx8-68qr+3450 more

Published 02-02-2026Last modified 03-02-2026

Vulnerability summary

CVE-2026-24051 is a high (CVSS 7.0) Untrusted Search Path vulnerability in open-telemetry opentelemetry-go. EPSS estimates a 0.18% chance of exploitation in the next 30 days, higher than 7.1% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 7, local access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

7.0/10

010

High · v3.1 (CVE.org)

EPSS score

0.18%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 5 · Related 6

OPENSUSE-SU-2026:10396-1 OPENSUSE-SU-2026:10613-1 OPENSUSE-SU-2026:10684-1 OPENSUSE-SU-2026:21483-1 SUSE-SU-2026:0757-1 CGA-MQPQ-RVMW-8RPR

Timeline

02-02-2026
PublishedVulnerability first disclosed.
03-02-2026
Last modifiedVulnerability information updated.

Description

OpenTelemetry-Go is the Go implementation of OpenTelemetry. The OpenTelemetry Go SDK in version v1.20.0-1.39.0 is vulnerable to Path Hijacking (Untrusted Search Paths) on macOS/Darwin systems. The resource detection code in sdk/resource/host_id.go executes the ioreg system command using a search path. An attacker with the ability to locally modify the PATH environment variable can achieve Arbitrary Code Execution (ACE) within the context of the application. A fix was released with v1.40.0.

CVSS metrics

5 scores · 5 sources · 1 version

v3.17.0

EPSS trend

Probability

0.18%

Chance of exploitation in the next 30 days

Percentile

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.18% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-426Untrusted Search PathThe product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.

Affected systems

Version check

Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard200 products

agentbeatAll versions (No fix recorded)
agentbeat-fipsAll versions (No fix recorded)
amazon-cloudwatch-agentAll versions (No fix recorded)
amazon-cloudwatch-agent-fipsAll versions (No fix recorded)
ansible-operator< 1.42.0-r9

ansible-operator-fips< 1.42.0-r7
apisix-ingress-controllerAll versions (No fix recorded)
apm-server-8.17< 8.17.10-r6
apm-server-8.18< 8.18.8-r5
apm-server-8.19All versions (No fix recorded)
apm-server-9.0< 9.0.8-r4
apm-server-9.1< 9.1.10-r2
apm-server-9.2< 9.2.5-r2
apm-server-9.3< 9.3.0-r1
apm-server-fips-8.17< 8.17.10-r5
apm-server-fips-8.18< 8.18.8-r5
apm-server-fips-8.19All versions (No fix recorded)
apm-server-fips-9.0< 9.0.8-r5
apm-server-fips-9.1< 9.1.10-r2
apm-server-fips-9.2All versions (No fix recorded)
apm-server-fips-9.3< 9.3.0-r1
argo-cd-2.14All versions (No fix recorded)
argo-cd-2.14-compatAll versions (No fix recorded)
argo-cd-3.0All versions (No fix recorded)
argo-cd-3.0-compatAll versions (No fix recorded)
argo-cd-3.1All versions (No fix recorded)
argo-cd-3.1-compatAll versions (No fix recorded)
argo-cd-3.2All versions (No fix recorded)
argo-cd-3.2-compatAll versions (No fix recorded)
argo-cd-3.3All versions (No fix recorded)
argo-cd-3.3-compatAll versions (No fix recorded)
argo-cd-fips-2.14All versions (No fix recorded)
argo-cd-fips-2.14-compatAll versions (No fix recorded)
argo-cd-fips-3.0< 3.0.23-r9
argo-cd-fips-3.0-compat< 3.0.23-r9
argo-cd-fips-3.1< 3.1.12-r4
argo-cd-fips-3.1-compat< 3.1.12-r4
argo-cd-fips-3.2< 3.2.7-r2
argo-cd-fips-3.2-compat< 3.2.7-r2
argo-cd-fips-3.3< 3.3.2-r2
argo-cd-fips-3.3-compat< 3.3.2-r2
argo-rolloutsAll versions (No fix recorded)
argo-rollouts-fips< 1.8.4-r3
argo-workflow-controller-3.6All versions (No fix recorded)
argo-workflow-controller-3.7All versions (No fix recorded)
argo-workflow-controller-4.0< 4.0.1-r3
argo-workflow-controller-fips-3.6All versions (No fix recorded)
argo-workflow-controller-fips-3.7All versions (No fix recorded)
argo-workflow-controller-fips-4.0< 4.0.1-r3
argo-workflow-executor-3.6All versions (No fix recorded)
argo-workflow-executor-3.7All versions (No fix recorded)
argo-workflow-executor-4.0< 4.0.1-r3
argo-workflow-executor-fips-3.6All versions (No fix recorded)
argo-workflow-executor-fips-3.7All versions (No fix recorded)
argo-workflow-executor-fips-4.0< 4.0.1-r3
argo-workflows-3.6All versions (No fix recorded)
argo-workflows-3.7All versions (No fix recorded)
argo-workflows-4.0< 4.0.1-r3
argo-workflows-fips-3.6All versions (No fix recorded)
argo-workflows-fips-3.7All versions (No fix recorded)
argo-workflows-fips-4.0< 4.0.1-r3
argocd-image-updater< 1.1.1-r2
argocd-image-updater-fips< 1.1.1-r2
auditbeat-9.0All versions (No fix recorded)
auditbeat-fips-9.0All versions (No fix recorded)
auditbeat-fips-9.1All versions (No fix recorded)
auditbeat-fips-9.2All versions (No fix recorded)
aws-ebs-csi-driver-1.49All versions (No fix recorded)
aws-ebs-csi-driver-1.50< 1.50.3-r4
aws-ebs-csi-driver-1.51< 1.51.2-r4
aws-ebs-csi-driver-1.52< 1.52.1-r5
aws-ebs-csi-driver-1.53< 1.53.0-r4
aws-ebs-csi-driver-1.54< 1.54.0-r4
aws-ebs-csi-driver-1.55All versions (No fix recorded)
aws-ebs-csi-driver-fips-1.49All versions (No fix recorded)
aws-ebs-csi-driver-fips-1.50< 1.50.3-r4
aws-ebs-csi-driver-fips-1.51< 1.51.2-r4
aws-ebs-csi-driver-fips-1.52< 1.52.1-r4
aws-ebs-csi-driver-fips-1.53< 1.53.0-r4
aws-ebs-csi-driver-fips-1.54< 1.54.0-r3
aws-ebs-csi-driver-fips-1.55< 1.55.0-r2
aws-node-termination-handler< 1.25.4-r3
aws-node-termination-handler-fips< 1.25.4-r3
aws-otel-collector< 0.47.0-r2
aws-otel-collector-fips< 0.47.0-r2
azcopy< 10.32.1-r1
azcopy-fips< 10.32.1-r1
azure-service-operator< 2.18.0-r2
azure-service-operator-fipsAll versions (No fix recorded)
azure-workload-identity-webhook< 1.5.1-r8
azuredisk-csi-1.29All versions (No fix recorded)
azuredisk-csi-1.30< 1.30.12-r12 | All versions (No fix recorded)
azuredisk-csi-1.31< 1.31.12-r8
azuredisk-csi-1.32< 1.32.12-r2
azuredisk-csi-1.33< 1.33.8-r3
azuredisk-csi-1.34< 1.34.1-r2
azuredisk-csi-fips-1.30< 1.30.12-r11
azuredisk-csi-fips-1.31< 1.31.12-r8
azuredisk-csi-fips-1.32< 1.32.12-r2
azuredisk-csi-fips-1.33< 1.33.8-r3
azuredisk-csi-fips-1.34< 1.34.2-r0
azurefile-csi-1.29< 1.29.12-r12
azurefile-csi-1.30< 1.30.10-r12
azurefile-csi-1.31< 1.31.8-r9
azurefile-csi-1.32< 1.32.9-r5
azurefile-csi-1.33< 1.33.7-r4
azurefile-csi-1.34< 1.34.3-r4
azurefile-csi-1.35< 1.35.0-r2
azurefile-csi-fips-1.29< 1.29.12-r12
azurefile-csi-fips-1.30< 1.30.10-r13
azurefile-csi-fips-1.31< 1.31.8-r10
azurefile-csi-fips-1.32< 1.32.9-r4
azurefile-csi-fips-1.33< 1.33.7-r4
azurefile-csi-fips-1.34< 1.34.3-r4
azurefile-csi-fips-1.35< 1.35.0-r3
backup-restore-operator-7.0< 7.0.5-r2
backup-restore-operator-8.1All versions (No fix recorded)
backup-restore-operator-9.0< 9.0.1-r2
backup-restore-operator-fips-7.0< 7.0.5-r2
backup-restore-operator-fips-8.1< 8.1.2-r2
backup-restore-operator-fips-9.0< 9.0.1-r2
bank-vaults< 1.32.1-r3
bank-vaults-fips< 1.32.1-r1
bank-vaults-template< 1.32.1-r3
bank-vaults-template-fips< 1.32.1-r1
bentoAll versions (No fix recorded)
bento-fipsAll versions (No fix recorded)
blob-csi-1.25< 1.25.10-r10
blob-csi-1.26< 1.26.9-r3
blob-csi-1.27< 1.27.2-r2
blob-csi-fips-1.25< 1.25.10-r10
blob-csi-fips-1.26< 1.26.9-r2
blob-csi-fips-1.27< 1.27.2-r2
boring-registry< 0.16.6-r9
boring-registry-fips< 0.16.6-r8
buildctl< 0.27.1-r5
buildctl-fips< 0.27.1-r3
buildkitd< 0.27.1-r5
buildkitd-fips< 0.27.1-r3
calico-apiserver-3.29All versions (No fix recorded)
calico-apiserver-3.30All versions (No fix recorded)
calico-apiserver-3.31< 3.31.4-r1
calico-apiserver-fips-3.29All versions (No fix recorded)
calico-apiserver-fips-3.30All versions (No fix recorded)
calico-apiserver-fips-3.31< 3.31.4-r2
calico-felix-3.30All versions (No fix recorded)
calico-felix-fips-3.30All versions (No fix recorded)
calico-goldmane-3.30All versions (No fix recorded)
calico-goldmane-fips-3.30All versions (No fix recorded)
calico-kube-controllers-3.29All versions (No fix recorded)
calico-kube-controllers-3.30All versions (No fix recorded)
calico-kube-controllers-3.31< 3.31.4-r1
calico-kube-controllers-fips-3.29All versions (No fix recorded)
calico-kube-controllers-fips-3.30All versions (No fix recorded)
calico-kube-controllers-fips-3.31< 3.31.4-r2
calico-node-3.30All versions (No fix recorded)
calico-node-fips-3.30All versions (No fix recorded)
calico-whisker-backend-3.30All versions (No fix recorded)
calico-whisker-backend-fips-3.30All versions (No fix recorded)
cass-operator< 1.29.0-r1
cass-operator-fips< 1.29.0-r1
cass-operator-fips-no-pvc-delete< 1.29.0-r1
ceph-csi-operator< 0.5.0-r1
ceph-csi-operator-fips< 0.5.0-r1
cerbos< 0.51.0-r5
cerbos-fips< 0.51.0-r3
cerbosctl< 0.51.0-r5
cerbosctl-fips< 0.51.0-r3
cert-manager-1.18< 1.18.6-r1
cert-manager-controller-1.18< 1.18.6-r1
cert-manager-controller-fips-1.18All versions (No fix recorded)
cert-manager-fips-1.17All versions (No fix recorded)
cert-manager-fips-1.18All versions (No fix recorded)
cert-manager-webhook-1.18< 1.18.6-r1
cert-manager-webhook-fips-1.18All versions (No fix recorded)
cert-manager-webhook-pdns< 2.5.3-r8
cert-manager-webhook-pdns-fips< 2.5.3-r8
clickhouse-operatorAll versions (No fix recorded)
clickhouse-operator-fipsAll versions (No fix recorded)
clickhouse-operator-fips-metrics-exporterAll versions (No fix recorded)
clickhouse-operator-metrics-exporterAll versions (No fix recorded)
cloud-provider-aws-1.28-cloud-controller-managerAll versions (No fix recorded)
cloud-provider-aws-1.30-cloud-controller-managerAll versions (No fix recorded)
cloud-provider-aws-1.31-cloud-controller-manager< 1.31.9-r4
cloud-provider-aws-1.33-cloud-controller-managerAll versions (No fix recorded)
cloud-provider-aws-1.34-cloud-controller-managerAll versions (No fix recorded)
cloud-provider-aws-1.35-cloud-controller-manager< 1.35.0-r1
cloud-provider-aws-fips-1.28-cloud-controller-managerAll versions (No fix recorded)
cloud-provider-aws-fips-1.31-cloud-controller-manager< 1.31.9-r6
cloud-provider-aws-fips-1.33-cloud-controller-managerAll versions (No fix recorded)
cloud-provider-aws-fips-1.34-cloud-controller-managerAll versions (No fix recorded)
cloud-provider-aws-fips-1.35-cloud-controller-manager< 1.35.0-r2
cloud-provider-azure-cloud-controller-manager-1.27All versions (No fix recorded)
cloud-provider-azure-cloud-controller-manager-1.28< 1.28.14-r20
cloud-provider-azure-cloud-controller-manager-1.29< 1.29.15-r10
cloud-provider-azure-cloud-controller-manager-1.30< 1.30.15-r6
cloud-provider-azure-cloud-controller-manager-1.31< 1.31.12-r5
cloud-provider-azure-cloud-controller-manager-1.32< 1.32.13-r1
cloud-provider-azure-cloud-controller-manager-1.33< 1.33.8-r1
cloud-provider-azure-cloud-controller-manager-1.34< 1.34.5-r1

Show all 200

1 vendor · 200 products · Showing 200 of 1853

References

7 links

github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-9h8m-3fm2-qjrqX Refsource CONFIRMAdvisoryWEBPatchVendor Advisory
github.com/open-telemetry/opentelemetry-go/commit/d45961bcda453fcbdb6469c22d6e88a1f9970a53X Refsource MISCFIXWEBPatch
github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24051.jsonAdvisory
nvd.nist.gov/vuln/detail/CVE-2026-24051Advisory
github.com/open-telemetry/opentelemetry-goPACKAGE
pkg.go.dev/vuln/GO-2026-4394WEB
www.suse.com/security/cve/CVE-2026-24051WEB