REDHAT-BUG-2456718: High severity OpenTelemetry OpenTelemetry-Go vulnerability
OpenTelemetry-Go is the Go implementation of OpenTelemetry. From 1.15.0 to 1.42.0, the fix for CVE-2026-24051 changed the Darwin ioreg command to use an absolute path but left the BSD kenv command using a bare name, allowing the same PATH hijacking attack on BSD and Solaris platforms. This vulnerability is fixed in 1.43.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
opentelemetry-goto a version that resolves this vulnerability.Fixed in 1.43.0Patch CVE-2026-24051
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2456718?
The severity of REDHAT-BUG-2456718 is high with a score of 7.
How do I fix REDHAT-BUG-2456718?
To fix REDHAT-BUG-2456718, update to OpenTelemetry-Go version 1.42.1 or later.
What platforms are affected by REDHAT-BUG-2456718?
REDHAT-BUG-2456718 affects BSD and Solaris platforms.
What specific command is involved in REDHAT-BUG-2456718?
The vulnerability involves the BSD kenv command which is susceptible to PATH hijacking.
What versions of OpenTelemetry-Go are impacted by REDHAT-BUG-2456718?
OpenTelemetry-Go versions from 1.15.0 to 1.42.0 are impacted by REDHAT-BUG-2456718.