CVE-2026-24051: OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution via PATH Hijacking

February 2, 2026 (updated February 3, 2026)

The OpenTelemetry Go SDK in version v1.20.0-1.39.0 is vulnerable to Path Hijacking (Untrusted Search Paths) on macOS/Darwin systems. The resource detection code in sdk/resource/host_id.go executes the ioreg system command using a search path. An attacker with the ability to locally modify the PATH environment variable can achieve Arbitrary Code Execution (ACE) within the context of the application.

References

github.com/advisories/GHSA-9h8m-3fm2-qjrq
github.com/open-telemetry/opentelemetry-go
github.com/open-telemetry/opentelemetry-go/commit/d45961bcda453fcbdb6469c22d6e88a1f9970a53
github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-9h8m-3fm2-qjrq
nvd.nist.gov/vuln/detail/CVE-2026-24051

Code Behaviors & Features

Detect and mitigate CVE-2026-24051 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →