CVE-2026-24051

Aliases:GHSA-9h8m-3fm2-qjrqGO-2026-4394
Advisory lineage Upstream: 0 Downstream: 5
Analyzed
Published: 02 Feb 2026, 19:49
Last modified:03 Feb 2026, 14:54

Vulnerability Summary

Overall Risk (default)
medium
28/100
CVSS Score
7 HIGH
v3.1 (cve.org)
EPSS Score
0.02% LOW
0% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

02 Feb 2026, 19:49
Published
Vulnerability first disclosed
03 Feb 2026, 14:54
Last Modified
Vulnerability information updated

Description

OpenTelemetry-Go is the Go implementation of OpenTelemetry. The OpenTelemetry Go SDK in version v1.20.0-1.39.0 is vulnerable to Path Hijacking (Untrusted Search Paths) on macOS/Darwin systems. The resource detection code in sdk/resource/host_id.go executes the ioreg system command using a search path. An attacker with the ability to locally modify the PATH environment variable can achieve Arbitrary Code Execution (ACE) within the context of the application. A fix was released with v1.40.0.

CVSS Metrics

  • v3.1•HIGH•Score: 7CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Trends

Current EPSS score: 0.02%• Percentile: 4%

Techniques & Countermeasures

  • CWE-426•Untrusted Search Path

    The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.

Affected Systems

  • go.opentelemetry.io/otel•sdk

    ≥ 1.21.0, < 1.40.0

  • go.opentelemetry.io/otel/sdk•resource

    ≥ 1.21.0, < 1.40.0

  • linuxfoundation•opentelemetry-go

    ≥ 1.21.0, < 1.40.0

  • open-telemetry•opentelemetry-go

    ≥ 1.21.0, < 1.40.0

References (5)