CVE-2026-24051: OpenTelemetry-Go Affected by Arbitrary Code Execution via PATH Hijacking
Impact The OpenTelemetry Go SDK in version v1.20.0-1.39.0 is vulnerable to Path Hijacking (Untrusted Search Paths) on macOS/Darwin systems. The resource detection code in sdk/resource/hostid.go executes the ioreg system command using a search path. An attacker with the ability to locally modify the PATH environment variable can achieve Arbitrary Code Execution (ACE) within the context of the application.
Patches This has been patched in d45961b, which was released with v1.40.0.
References - CWE-426: Untrusted Search Path
Other sources
OpenTelemetry-Go is the Go implementation of OpenTelemetry. The OpenTelemetry Go SDK in version v1.20.0-1.39.0 is vulnerable to Path Hijacking (Untrusted Search Paths) on macOS/Darwin systems. The resource detection code in sdk/resource/hostid.go executes the ioreg system command using a search path. An attacker with the ability to locally modify the PATH environment variable can achieve Arbitrary Code Execution (ACE) within the context of the application. A fix was released with v1.40.0.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/go.opentelemetry.io/otel/sdk/resourceto a version that resolves this vulnerability.Fixed in 1.40.0 - Upgrade
Upgrade
go/go.opentelemetry.io/otel/sdk/resourceto a version that resolves this vulnerability.Fixed in 1.40.0Patch d45961bcda453fcbdb6469c22d6e88a1f9970a53
Event History
Frequently Asked Questions
What is the severity of CVE-2026-24051?
CVE-2026-24051 has a moderate severity level due to the potential for path hijacking that could affect system integrity.
How do I fix CVE-2026-24051?
To fix CVE-2026-24051, upgrade the OpenTelemetry Go SDK to version 1.40.0 or later.
Which versions of OpenTelemetry Go SDK are affected by CVE-2026-24051?
Versions v1.20.0 to v1.39.0 of the OpenTelemetry Go SDK are affected by CVE-2026-24051.
What operating systems are impacted by CVE-2026-24051?
CVE-2026-24051 affects macOS/Darwin systems specifically.
What types of attacks can CVE-2026-24051 facilitate?
CVE-2026-24051 can facilitate path hijacking attacks, allowing unauthorized access to system resources through untrusted search paths.