open-telemetry/opentelemetry-go · Security
OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution via PATH Hijacking
- GHSA ID
- GHSA-9h8m-3fm2-qjrq
- CVE ID
- CVE-2026-24051
- Severity
- high
- Published
- Updated
- CVSS
- 7 · CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS v3
- 7 · CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Description
Impact
The OpenTelemetry Go SDK in version v1.20.0-1.39.0 is vulnerable to Path Hijacking (Untrusted Search Paths) on macOS/Darwin systems. The resource detection code in sdk/resource/host_id.go executes the ioreg system command using a search path. An attacker with the ability to locally modify the PATH environment variable can achieve Arbitrary Code Execution (ACE) within the context of the application.
Patches
This has been patched in d45961b, which was released with v1.40.0.
References
CWEs
- CWE-426 · Untrusted Search Path
References
- https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-9h8m-3fm2-qjrq ↗
- https://github.com/open-telemetry/opentelemetry-go/commit/d45961bcda453fcbdb6469c22d6e88a1f9970a53 ↗
- https://nvd.nist.gov/vuln/detail/CVE-2026-24051 ↗
- https://pkg.go.dev/vuln/GO-2026-4394 ↗
- https://github.com/advisories/GHSA-9h8m-3fm2-qjrq ↗