What is the CVSS score of CVE-2026-24051?

CVE-2026-24051 has a contested CVSS base score of 7.0 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Opentelemetry Go are affected by CVE-2026-24051?

OpenTelemetry-Go SDK versions 1.20.0 through 1.39.0 are vulnerable to path hijacking attacks on macOS systems, potentially allowing attackers to execute arbitrary code or access sensitive data.. A patch is available.

How to fix or mitigate CVE-2026-24051?

Within 24 hours: Inventory all systems running OpenTelemetry-Go SDK versions 1.20.0-1.39.0, particularly macOS-based infrastructure and development environments. Within 7 days: Apply available patches to all affected systems and verify successful deployment. Within 30 days: Conduct code review of any custom implementations using affected OpenTelemetry versions and perform security testing to confirm remediation.

Opentelemetry Go CVE-2026-24051

HIGH

Untrusted Search Path (CWE-426)

2026-02-02 security-advisories@github.com

GHSA-9h8m-3fm2-qjrq

Opentelemetry Go Apple RCE

High

Disputed · 7.0 Vendor: github

Severity by source

Sources disagree (Low–High)

Vendor (github) PRIMARY

7.0 HIGH

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

SUSE

3.1 LOW

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: github

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:01 vuln.today

Patch released

Feb 27, 2026 - 20:32 nvd

Patch available

CVE Published

Feb 02, 2026 - 23:16 nvd

HIGH 7.0

DescriptionCVE.org

OpenTelemetry-Go is the Go implementation of OpenTelemetry. The OpenTelemetry Go SDK in version v1.20.0-1.39.0 is vulnerable to Path Hijacking (Untrusted Search Paths) on macOS/Darwin systems. The resource detection code in sdk/resource/host_id.go executes the ioreg system command using a search path. An attacker with the ability to locally modify the PATH environment variable can achieve Arbitrary Code Execution (ACE) within the context of the application. A fix was released with v1.40.0.

AnalysisAI

Arbitrary code execution in OpenTelemetry Go SDK versions 1.20.0 through 1.39.0 on macOS results from insecure PATH resolution when executing the ioreg system command during resource detection. A local attacker with the ability to modify the PATH environment variable can hijack the command search path and execute arbitrary code with the privileges of the affected application. The vulnerability is resolved in version 1.40.0 and later.

Technical ContextAI

Classified as CWE-426 (Untrusted Search Path). Affects Opentelemetry-Go. OpenTelemetry-Go is the Go implementation of OpenTelemetry. The OpenTelemetry Go SDK in version v1.20.0-1.39.0 is vulnerable to Path Hijacking (Untrusted Search Paths) on macOS/Darwin systems. The resource detection code in sdk/resource/host_id.go executes the ioreg system command using a search path. An attacker with the ability to locally modify the PATH environment variable can achieve Arbitrary Code Execution (ACE) within the context of the application. A fix was released with v1.40.0.

RemediationAI

A vendor patch is available — apply it immediately.

Same weakness CWE-426 – Untrusted Search Path

View all

CVE-2015-0096 CRITICAL POC

9.3

CVE-2012-1854 HIGH POC

7.8

CVE-2016-5330 HIGH POC

7.8

CVE-2019-11660 HIGH POC

7.8

CVE-2017-12414 CRITICAL POC

9.8

CVE-2025-26155 CRITICAL POC

9.8

CVE-2023-30330 CRITICAL POC

9.8

CVE-2023-26036 CRITICAL POC

9.8

Same technique RCE

View all

CVE-2017-7269 CRITICAL POC

9.8

CVE-2012-4681 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2016-4117 CRITICAL POC

9.8

CVE-2015-3113 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2025-53770 CRITICAL POC

9.8

CVE-2020-7961 CRITICAL POC

9.8

Vendor StatusVendor

SUSE

Severity: Low

Product	Status
openSUSE Tumbleweed	Fixed
openSUSE Leap 15.6	Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP5	Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP6	Fixed
openSUSE Leap 15.5	Fixed

CVE-2026-24051 vulnerability details – vuln.today

Back

Opentelemetry Go CVE-2026-24051

Severity by source

CVSS VectorVendor: github

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same weakness CWE-426 – Untrusted Search Path

Same technique RCE

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code