GitHub Advisoryadvisory · Go

GHSA-9h8m-3fm2-qjrq OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution via PATH Hijacking

HIGH Published 2026-02-02 Modified 2026-02-27 Official page ↗
Aliases
CVE-2026-24051
Ecosystem
Go
Packages
go.opentelemetry.io/otel/sdk
Severity
High
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-426
Reviewed
2026-02-02

Affected packages

• Go go.opentelemetry.io/otel/sdk: >= 1.21.0, < 1.40.0 → fixed in 1.40.0

Description

Impact The OpenTelemetry Go SDK in version `v1.20.0`-`1.39.0` is vulnerable to Path Hijacking (Untrusted Search Paths) on macOS/Darwin systems. The resource detection code in `sdk/resource/host_id.go` executes the `ioreg` system command using a search path. An attacker with the ability to locally modify the PATH environment variable can achieve Arbitrary Code Execution (ACE) within the context of the application. Patches This has been patched in d45961b, which was released with `v1.40.0`. References • CWE-426: Untrusted Search Path

Related

Alias · CVE (1)

  • CVE-2026-24051 OpenTelemetry-Go is the Go implementation of OpenTelemetry. vulnerability

Weakness · CWE (1)

  • CWE-426 Untrusted Search Path weakness

References