CVE-2026-24051
High
Description
OpenTelemetry-Go is the Go implementation of OpenTelemetry. The OpenTelemetry Go SDK in version v1.20.0-1.39.0 is vulnerable to Path Hijacking (Untrusted Search Paths) on macOS/Darwin systems. The resource detection code in sdk/resource/host_id.go executes the ioreg system command using a search path. An attacker with the ability to locally modify the PATH environment variable can achieve Arbitrary Code Execution (ACE) within the context of the application. A fix was released with v1.40.0.
SeverityHigh
CVSS7.0
Exploit probability—
Product
Opentelemetry
PublishedFeb 2, 2026
First seenFeb 2, 2026
Weakness typeCWE-426CWE-426
How to fix
Update
- opentelemetry opentelemetry1.40.0 or later
- go.opentelemetry.io/otel/sdk1.40.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| opentelemetry opentelemetry | 1.21.0 ≤ v < 1.40.0 | 1.40.0 |
| go.opentelemetry.io/otel/sdkGo | 1.21.0 ≤ v < 1.40.0 | 1.40.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.