CVE-2026-24051— OpenTelemetry-Go Affected by Arbitrary Code Execution via PATH Hijacking
Quick assessment
Affected
open-telemetry opentelemetry-go
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
OpenTelemetry-Go是OpenTelemetry - CNCF开源的一个开发者工具包。 OpenTelemetry-Go v1.20.0-1.39.0版本存在代码问题漏洞，该漏洞源于资源检测代码执行ioreg命令时存在路径劫持，可能导致任意代码执行。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-24051
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
OpenTelemetry-Go Affected by Arbitrary Code Execution via PATH Hijacking
Source: CVE Program / CVE List V5
Vulnerability Description
OpenTelemetry-Go is the Go implementation of OpenTelemetry. The OpenTelemetry Go SDK in version v1.20.0-1.39.0 is vulnerable to Path Hijacking (Untrusted Search Paths) on macOS/Darwin systems. The resource detection code in sdk/resource/host_id.go executes the ioreg system command using a search path. An attacker with the ability to locally modify the PATH environment variable can achieve Arbitrary Code Execution (ACE) within the context of the application. A fix was released with v1.40.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
不可信的搜索路径
Source: CVE Program / CVE List V5
Vulnerability Title
OpenTelemetry-Go 代码问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
OpenTelemetry-Go是OpenTelemetry - CNCF开源的一个开发者工具包。 OpenTelemetry-Go v1.20.0-1.39.0版本存在代码问题漏洞，该漏洞源于资源检测代码执行ioreg命令时存在路径劫持，可能导致任意代码执行。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| open-telemetry | opentelemetry-go | >= 1.21.0, < 1.40.0 | - |
|
II. Public POCs for CVE-2026-24051
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-24051
请登录查看更多情报信息。
IV. Related Vulnerabilities
Same product: opentelemetry-go
-
CVE-2026-81871
OpenTelemetry-Go: Log gRPC exporter ignores env TLS certs, b -
CVE-2026-81872
OpenTelemetry-Go: BatchProcessor can busy-spin when export b -
CVE-2026-81869
OpenTelemetry-Go: UTF-8 replacement rune bypasses attribute -
CVE-2026-81870
OpenTelemetry-Go: Exporter config logging may leak endpoint -
CVE-2026-45404
OpenTelemetry-Go: Unsynchronized baggage map can panic under
Same vendor: open-telemetry
-
CVE-2026-81871
OpenTelemetry-Go: Log gRPC exporter ignores env TLS certs, b -
CVE-2026-81872
OpenTelemetry-Go: BatchProcessor can busy-spin when export b -
CVE-2026-81869
OpenTelemetry-Go: UTF-8 replacement rune bypasses attribute -
CVE-2026-81870
OpenTelemetry-Go: Exporter config logging may leak endpoint -
CVE-2026-55701
OpenTelemetry githubreceiver silently ignores configured req
Same weakness: CWE-426
-
CVE-2026-19547
Local Privilege Escalation in Ghostscript for Windows -
CVE-2026-87723
Untrusted Search Path (PATH Hijacking) in fuse-archive -
CVE-2026-100584
OpenClaw before 2026.7.1 Allowlist Bypass via Workspace Shad -
CVE-2026-100310
GNU libextractor before 1.16 Privilege Escalation via LIBEXT -
CVE-2026-68492
Plesk 18.0.34-18.0.81 路径遍历漏洞
V. Comments for CVE-2026-24051
No comments yet