Opentelemetry Go
CVE-2026-24051
HIGH
GHSA-9h8m-3fm2-qjrq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessModify PATH environment variable
-
ExploitInject malicious ioreg executable
-
ExecutionResource detection code executes hijacked command
-
ImpactArbitrary code execution in application context
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V13 - Configuration Search path verification
|
| Exploitation Conditions | OpenTelemetry-Go SDK versions v1.20.0 through v1.39.0 on macOS/Darwin systems with resource detection enabled; attacker must have local system access to modify PATH environment variable before application initialization |
| Impact | CVSS 7.0 (HIGH). Attack vector: Local. Complexity: High. Privileges required: Low. User interaction: None. Exploitable via local access. |
| Exploit ScenarioDerived | An attacker could exploit this vulnerability to compromise the affected system. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
Arbitrary code execution in OpenTelemetry Go SDK versions 1.20.0 through 1.39.0 on macOS results from insecure PATH resolution when executing the ioreg system command during resource detection. A local attacker with the ability to modify the PATH environment variable can hijack the command search path and execute arbitrary code with the privileges of the affected application. The vulnerability is resolved in version 1.40.0 and later.
Earlier versions of this analysis (1)
OpenTelemetry-Go is the Go implementation of OpenTelemetry. The OpenTelemetry Go SDK in version v1.20.0-1.39.0 is vulnerable to Path Hijacking (Untrusted Search Paths) on macOS/Darwin systems. [CVSS 7.0 HIGH]
RemediationAI
A vendor patch is available — apply it immediately.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in go
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Classified as CWE-426 (Untrusted Search Path). Affects Opentelemetry-Go. OpenTelemetry-Go is the Go implementation of OpenTelemetry. The OpenTelemetry Go SDK in version v1.20.0-1.39.0 is vulnerable to Path Hijacking (Untrusted Search Paths) on macOS/Darwin systems. The resource detection code in sdk/resource/host_id.go executes the ioreg system command using a search path. An attacker with the ability to locally modify the PATH environment variable can achieve Arbitrary Code Execution (ACE) within the context of the application. A fix was released with v1.40.0.
Know when Opentelemetry Go gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Low–High)AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: github
Lifecycle Timeline
2DescriptionCVE.org
OpenTelemetry-Go is the Go implementation of OpenTelemetry. The OpenTelemetry Go SDK in version v1.20.0-1.39.0 is vulnerable to Path Hijacking (Untrusted Search Paths) on macOS/Darwin systems. The resource detection code in sdk/resource/host_id.go executes the ioreg system command using a search path. An attacker with the ability to locally modify the PATH environment variable can achieve Arbitrary Code Execution (ACE) within the context of the application. A fix was released with v1.40.0.
Executive ViewAI
OpenTelemetry-Go SDK versions 1.20.0 through 1.39.0 are vulnerable to path hijacking attacks on macOS systems, potentially allowing attackers to execute arbitrary code or access sensitive data. Organizations running these versions on macOS infrastructure should prioritize immediate patching to eliminate this attack vector.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Affected Products (CPE)CVE.org
More in Opentelemetry Go
View allCPU exhaustion in the OpenTelemetry-Go sdk/log BatchProcessor (BatchingProcessor built via NewBatchingProcessor) before
Span attribute length limits can be bypassed in the OpenTelemetry-Go SDK trace package from 1.10.0 up to (but not includ
Log telemetry exported over gRPC by OpenTelemetry-Go versions prior to 0.21.0 can be silently intercepted or modified be
OpenTelemetry-Go versions 1.5.0 through 1.44.0 can write sensitive collector configuration into an application's own log
Same weakness CWE-426 – Untrusted Search Path
View allVendor StatusVendor
SUSE
Severity: Low| Product | Status |
|---|---|
| openSUSE Tumbleweed | Fixed |
| openSUSE Leap 15.6 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Fixed |
| openSUSE Leap 15.5 | Fixed |
Exploit-DB