CVE-2026-24051
High · 7.0CVSS
7.0
EPSS
0.2%
Published
Feb 2, 2026
CISA due date
—
The record
OpenTelemetry-Go is the Go implementation of OpenTelemetry. The OpenTelemetry Go SDK in version v1.20.0-1.39.0 is vulnerable to Path Hijacking (Untrusted Search Paths) on macOS/Darwin systems. The resource detection code in sdk/resource/host_id.go executes the ioreg system command using a search path. An attacker with the ability to locally modify the PATH environment variable can achieve Arbitrary Code Execution (ACE) within the context of the application. A fix was released with v1.40.0.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | go.opentelemetry.io/otel/sdk | 1.21.0 | 1.40.0 |
| Chainguard | agentbeat | 0 | 0 |
| Chainguard | agentbeat-fips | 0 | 0 |
| Chainguard | amazon-cloudwatch-agent | 0 | 0 |
| Chainguard | amazon-cloudwatch-agent-fips | 0 | 0 |
| Chainguard | ansible-operator | 0 | 1.42.0-r9 |
| Chainguard | ansible-operator-fips | 0 | 1.42.0-r7 |
| Chainguard | apisix-ingress-controller | 0 | 0 |
| Chainguard | apm-server-8.17 | 0 | 8.17.10-r6 |
| Chainguard | apm-server-8.18 | 0 | 8.18.8-r5 |
| Chainguard | apm-server-8.19 | 0 | 0 |
| Chainguard | apm-server-9.0 | 0 | 9.0.8-r4 |
| Chainguard | apm-server-9.1 | 0 | 9.1.10-r2 |
| Chainguard | apm-server-9.2 | 0 | 9.2.5-r2 |
| Chainguard | apm-server-9.3 | 0 | 9.3.0-r1 |
| Chainguard | apm-server-fips-8.17 | 0 | 8.17.10-r5 |
| Chainguard | apm-server-fips-8.18 | 0 | 8.18.8-r5 |
| Chainguard | apm-server-fips-8.19 | 0 | 0 |
| Chainguard | apm-server-fips-9.0 | 0 | 9.0.8-r5 |
| Chainguard | apm-server-fips-9.1 | 0 | 9.1.10-r2 |
| Chainguard | apm-server-fips-9.2 | 0 | 0 |
| Chainguard | apm-server-fips-9.3 | 0 | 9.3.0-r1 |
| Chainguard | argo-cd-3.1 | 0 | 0 |
| Chainguard | argo-cd-3.1-compat | 0 | 0 |
| Chainguard | argo-cd-3.2 | 0 | 0 |
| Chainguard | argo-cd-3.2-compat | 0 | 0 |
| Chainguard | argo-cd-3.3 | 0 | 0 |
| Chainguard | argo-cd-3.3-compat | 0 | 0 |
| Chainguard | argo-cd-fips-3.1 | 0 | 3.1.12-r4 |
| Chainguard | argo-cd-fips-3.1-compat | 0 | 3.1.12-r4 |
| Chainguard | argo-cd-fips-3.2 | 0 | 3.2.7-r2 |
| Chainguard | argo-cd-fips-3.2-compat | 0 | 3.2.7-r2 |
| Chainguard | argo-cd-fips-3.3 | 0 | 3.3.2-r2 |
| Chainguard | argo-cd-fips-3.3-compat | 0 | 3.3.2-r2 |
| Chainguard | argo-rollouts | 0 | 0 |
| Chainguard | argo-rollouts-fips | 0 | 1.8.4-r3 |
| Chainguard | argo-workflow-controller-3.6 | 0 | 0 |
| Chainguard | argo-workflow-controller-3.7 | 0 | 0 |
| Chainguard | argo-workflow-controller-4.0 | 0 | 4.0.1-r3 |
| Chainguard | argo-workflow-controller-fips-3.6 | 0 | 0 |
| Chainguard | argo-workflow-controller-fips-3.7 | 0 | 0 |
| Chainguard | argo-workflow-controller-fips-4.0 | 0 | 4.0.1-r3 |
| Chainguard | argo-workflow-executor-3.6 | 0 | 0 |
| Chainguard | argo-workflow-executor-3.7 | 0 | 0 |
| Chainguard | argo-workflow-executor-4.0 | 0 | 4.0.1-r3 |
| Chainguard | argo-workflow-executor-fips-3.6 | 0 | 0 |
| Chainguard | argo-workflow-executor-fips-3.7 | 0 | 0 |
| Chainguard | argo-workflow-executor-fips-4.0 | 0 | 4.0.1-r3 |
| Chainguard | argo-workflows-3.6 | 0 | 0 |
| Chainguard | argo-workflows-3.7 | 0 | 0 |
| Chainguard | argo-workflows-4.0 | 0 | 4.0.1-r3 |
| Chainguard | argo-workflows-fips-3.6 | 0 | 0 |
| Chainguard | argo-workflows-fips-3.7 | 0 | 0 |
| Chainguard | argo-workflows-fips-4.0 | 0 | 4.0.1-r3 |
| Chainguard | argocd-image-updater | 0 | 1.1.1-r2 |
| Chainguard | argocd-image-updater-fips | 0 | 1.1.1-r2 |
| Chainguard | auditbeat-9.0 | 0 | 0 |
| Chainguard | auditbeat-fips-9.0 | 0 | 0 |
| Chainguard | auditbeat-fips-9.1 | 0 | 0 |
| Chainguard | auditbeat-fips-9.2 | 0 | 0 |
| Chainguard | aws-ebs-csi-driver-1.50 | 0 | 1.50.3-r4 |
| Chainguard | aws-ebs-csi-driver-1.51 | 0 | 1.51.2-r4 |
| Chainguard | aws-ebs-csi-driver-1.52 | 0 | 1.52.1-r5 |
| Chainguard | aws-ebs-csi-driver-1.53 | 0 | 1.53.0-r4 |
| Chainguard | aws-ebs-csi-driver-1.54 | 0 | 1.54.0-r4 |
| Chainguard | aws-ebs-csi-driver-1.55 | 0 | 0 |
| Chainguard | aws-ebs-csi-driver-fips-1.50 | 0 | 1.50.3-r4 |
| Chainguard | aws-ebs-csi-driver-fips-1.51 | 0 | 1.51.2-r4 |
| Chainguard | aws-ebs-csi-driver-fips-1.52 | 0 | 1.52.1-r4 |
| Chainguard | aws-ebs-csi-driver-fips-1.53 | 0 | 1.53.0-r4 |
| Chainguard | aws-ebs-csi-driver-fips-1.54 | 0 | 1.54.0-r3 |
| Chainguard | aws-ebs-csi-driver-fips-1.55 | 0 | 1.55.0-r2 |
| Chainguard | aws-node-termination-handler | 0 | 1.25.4-r3 |
| Chainguard | aws-node-termination-handler-fips | 0 | 1.25.4-r3 |
| Chainguard | aws-otel-collector | 0 | 0.47.0-r2 |
| Chainguard | aws-otel-collector-fips | 0 | 0.47.0-r2 |
| Chainguard | azcopy | 0 | 10.32.1-r1 |
| Chainguard | azcopy-fips | 0 | 10.32.1-r1 |
| Chainguard | azure-service-operator | 0 | 2.18.0-r2 |
| Chainguard | azure-service-operator-fips | 0 | 0 |
| Chainguard | azure-workload-identity-webhook | 0 | 1.5.1-r8 |
| Chainguard | azuredisk-csi-1.30 | 0 | 1.30.12-r12 |
| Chainguard | azuredisk-csi-1.31 | 0 | 1.31.12-r8 |
| Chainguard | azuredisk-csi-1.32 | 0 | 1.32.12-r2 |
| Chainguard | azuredisk-csi-1.33 | 0 | 1.33.8-r3 |
| Chainguard | azuredisk-csi-1.34 | 0 | 1.34.1-r2 |
| Chainguard | azuredisk-csi-fips-1.30 | 0 | 1.30.12-r11 |
| Chainguard | azuredisk-csi-fips-1.31 | 0 | 1.31.12-r8 |
| Chainguard | azuredisk-csi-fips-1.32 | 0 | 1.32.12-r2 |
| Chainguard | azuredisk-csi-fips-1.33 | 0 | 1.33.8-r3 |
| Chainguard | azuredisk-csi-fips-1.34 | 0 | 1.34.2-r0 |
| Chainguard | azurefile-csi-1.29 | 0 | 1.29.12-r12 |
| Chainguard | azurefile-csi-1.30 | 0 | 1.30.10-r12 |
| Chainguard | azurefile-csi-1.31 | 0 | 1.31.8-r9 |
| Chainguard | azurefile-csi-1.32 | 0 | 1.32.9-r5 |
| Chainguard | azurefile-csi-1.33 | 0 | 1.33.7-r4 |
| Chainguard | azurefile-csi-1.34 | 0 | 1.34.3-r4 |
| Chainguard | azurefile-csi-1.35 | 0 | 1.35.0-r2 |
| Chainguard | azurefile-csi-fips-1.29 | 0 | 1.29.12-r12 |
| Chainguard | azurefile-csi-fips-1.30 | 0 | 1.30.10-r13 |
| Chainguard | azurefile-csi-fips-1.31 | 0 | 1.31.8-r10 |
| Chainguard | azurefile-csi-fips-1.32 | 0 | 1.32.9-r4 |
| Chainguard | azurefile-csi-fips-1.33 | 0 | 1.33.7-r4 |
| Chainguard | azurefile-csi-fips-1.34 | 0 | 1.34.3-r4 |
| Chainguard | azurefile-csi-fips-1.35 | 0 | 1.35.0-r3 |
| Chainguard | backup-restore-operator-7.0 | 0 | 7.0.5-r2 |
| Chainguard | backup-restore-operator-8.1 | 0 | 0 |
| Chainguard | backup-restore-operator-9.0 | 0 | 9.0.1-r2 |
| Chainguard | backup-restore-operator-fips-7.0 | 0 | 7.0.5-r2 |
| Chainguard | backup-restore-operator-fips-8.1 | 0 | 8.1.2-r2 |
| Chainguard | backup-restore-operator-fips-9.0 | 0 | 9.0.1-r2 |
| Chainguard | bank-vaults | 0 | 1.32.1-r3 |
| Chainguard | bank-vaults-fips | 0 | 1.32.1-r1 |
| Chainguard | bank-vaults-template | 0 | 1.32.1-r3 |
| Chainguard | bank-vaults-template-fips | 0 | 1.32.1-r1 |
| Chainguard | bento | 0 | 0 |
| Chainguard | bento-fips | 0 | 0 |
| Chainguard | blob-csi-1.25 | 0 | 1.25.10-r10 |
| Chainguard | blob-csi-1.26 | 0 | 1.26.9-r3 |
| Chainguard | blob-csi-1.27 | 0 | 1.27.2-r2 |
| Chainguard | blob-csi-fips-1.25 | 0 | 1.25.10-r10 |
| Chainguard | blob-csi-fips-1.26 | 0 | 1.26.9-r2 |
| Chainguard | blob-csi-fips-1.27 | 0 | 1.27.2-r2 |
| Chainguard | boring-registry | 0 | 0.16.6-r9 |
| Chainguard | boring-registry-fips | 0 | 0.16.6-r8 |
| Chainguard | buildctl | 0 | 0.27.1-r5 |
| Chainguard | buildctl-fips | 0 | 0.27.1-r3 |
| Chainguard | buildkitd | 0 | 0.27.1-r5 |
| Chainguard | buildkitd-fips | 0 | 0.27.1-r3 |
| Chainguard | calico-apiserver-3.30 | 0 | 0 |
| Chainguard | calico-apiserver-3.31 | 0 | 3.31.4-r1 |
| Chainguard | calico-apiserver-fips-3.30 | 0 | 0 |
| Chainguard | calico-apiserver-fips-3.31 | 0 | 3.31.4-r2 |
| Chainguard | calico-felix-3.30 | 0 | 0 |
| Chainguard | calico-felix-fips-3.30 | 0 | 0 |
| Chainguard | calico-goldmane-3.30 | 0 | 0 |
| Chainguard | calico-goldmane-fips-3.30 | 0 | 0 |
| Chainguard | calico-kube-controllers-3.30 | 0 | 0 |
| Chainguard | calico-kube-controllers-3.31 | 0 | 3.31.4-r1 |
| Chainguard | calico-kube-controllers-fips-3.30 | 0 | 0 |
| Chainguard | calico-kube-controllers-fips-3.31 | 0 | 3.31.4-r2 |
| Chainguard | calico-node-3.30 | 0 | 0 |
| Chainguard | calico-node-fips-3.30 | 0 | 0 |
| Chainguard | calico-whisker-backend-3.30 | 0 | 0 |
| Chainguard | calico-whisker-backend-fips-3.30 | 0 | 0 |
| Chainguard | cass-operator | 0 | 1.29.0-r1 |
| Chainguard | cass-operator-fips | 0 | 1.29.0-r1 |
| Chainguard | cass-operator-fips-no-pvc-delete | 0 | 1.29.0-r1 |
| Chainguard | ceph-csi-operator | 0 | 0.5.0-r1 |
| Chainguard | ceph-csi-operator-fips | 0 | 0.5.0-r1 |
| Chainguard | cerbos | 0 | 0.51.0-r5 |
| Chainguard | cerbos-fips | 0 | 0.51.0-r3 |
| Chainguard | cerbosctl | 0 | 0.51.0-r5 |
| Chainguard | cerbosctl-fips | 0 | 0.51.0-r3 |
| Chainguard | cert-manager-1.18 | 0 | 1.18.6-r1 |
| Chainguard | cert-manager-controller-1.18 | 0 | 1.18.6-r1 |
| Chainguard | cert-manager-controller-fips-1.18 | 0 | 0 |
| Chainguard | cert-manager-fips-1.18 | 0 | 0 |
| Chainguard | cert-manager-webhook-1.18 | 0 | 1.18.6-r1 |
| Chainguard | cert-manager-webhook-fips-1.18 | 0 | 0 |
| Chainguard | cert-manager-webhook-pdns | 0 | 2.5.3-r8 |
| Chainguard | cert-manager-webhook-pdns-fips | 0 | 2.5.3-r8 |
| Chainguard | clickhouse-operator | 0 | 0 |
| Chainguard | clickhouse-operator-fips | 0 | 0 |
| Chainguard | clickhouse-operator-fips-metrics-exporter | 0 | 0 |
| Chainguard | clickhouse-operator-metrics-exporter | 0 | 0 |
| Chainguard | cloud-provider-aws-1.31-cloud-controller-manager | 0 | 1.31.9-r4 |
| Chainguard | cloud-provider-aws-1.33-cloud-controller-manager | 0 | 0 |
| Chainguard | cloud-provider-aws-1.34-cloud-controller-manager | 0 | 0 |
| Chainguard | cloud-provider-aws-1.35-cloud-controller-manager | 0 | 1.35.0-r1 |
| Chainguard | cloud-provider-aws-fips-1.31-cloud-controller-manager | 0 | 1.31.9-r6 |
| Chainguard | cloud-provider-aws-fips-1.33-cloud-controller-manager | 0 | 0 |
| Chainguard | cloud-provider-aws-fips-1.34-cloud-controller-manager | 0 | 0 |
| Chainguard | cloud-provider-aws-fips-1.35-cloud-controller-manager | 0 | 1.35.0-r2 |
| Chainguard | cloud-provider-azure-cloud-controller-manager-1.28 | 0 | 1.28.14-r20 |
| Chainguard | cloud-provider-azure-cloud-controller-manager-1.29 | 0 | 1.29.15-r10 |
| Chainguard | cloud-provider-azure-cloud-controller-manager-1.30 | 0 | 1.30.15-r6 |
| Chainguard | cloud-provider-azure-cloud-controller-manager-1.31 | 0 | 1.31.12-r5 |
| Chainguard | cloud-provider-azure-cloud-controller-manager-1.32 | 0 | 1.32.13-r1 |
| Chainguard | cloud-provider-azure-cloud-controller-manager-1.33 | 0 | 1.33.8-r1 |
| Chainguard | cloud-provider-azure-cloud-controller-manager-1.34 | 0 | 1.34.5-r1 |
| Chainguard | cloud-provider-azure-cloud-controller-manager-1.35 | 0 | 1.35.0-r1 |
| Chainguard | cloud-provider-azure-cloud-controller-manager-fips-1.29 | 0 | 1.29.15-r10 |
| Chainguard | cloud-provider-azure-cloud-controller-manager-fips-1.30 | 0 | 1.30.15-r7 |
| Chainguard | cloud-provider-azure-cloud-controller-manager-fips-1.31 | 0 | 1.31.12-r6 |
| Chainguard | cloud-provider-azure-cloud-controller-manager-fips-1.32 | 0 | 1.32.13-r2 |
| Chainguard | cloud-provider-azure-cloud-controller-manager-fips-1.33 | 0 | 1.33.8-r1 |
| Chainguard | cloud-provider-azure-cloud-controller-manager-fips-1.34 | 0 | 1.34.5-r1 |
| Chainguard | cloud-provider-azure-cloud-controller-manager-fips-1.35 | 0 | 1.35.0-r2 |
| Chainguard | cloud-provider-azure-cloud-node-manager-1.28 | 0 | 1.28.14-r20 |
| Chainguard | cloud-provider-azure-cloud-node-manager-1.29 | 0 | 1.29.15-r10 |
| Chainguard | cloud-provider-azure-cloud-node-manager-1.30 | 0 | 1.30.15-r6 |
| Chainguard | cloud-provider-azure-cloud-node-manager-1.31 | 0 | 1.31.12-r5 |
| Chainguard | cloud-provider-azure-cloud-node-manager-1.32 | 0 | 1.32.13-r1 |
| Chainguard | cloud-provider-azure-cloud-node-manager-1.33 | 0 | 1.33.8-r1 |
| Chainguard | cloud-provider-azure-cloud-node-manager-1.34 | 0 | 1.34.5-r1 |
| Chainguard | cloud-provider-azure-cloud-node-manager-1.35 | 0 | 1.35.0-r1 |
| Chainguard | cloud-provider-azure-cloud-node-manager-fips-1.29 | 0 | 1.29.15-r10 |
| Chainguard | cloud-provider-azure-cloud-node-manager-fips-1.30 | 0 | 1.30.15-r7 |
| Chainguard | cloud-provider-azure-cloud-node-manager-fips-1.31 | 0 | 1.31.12-r6 |
Related vulnerabilities
- CVE-2026-34986 Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of… Also affects agentbeat
- CVE-2026-33186 gRPC-Go is the Go language implementation of gRPC. Also affects agentbeat
- CVE-2026-27142 Actions which insert URLs into the content attribute of HTML meta tags are not escaped. Also affects agentbeat
- CVE-2026-27139 On Unix platforms, when listing the contents of a directory using File.ReadDir or… Also affects agentbeat
- CVE-2026-25679 url.Parse insufficiently validated the host/authority component and accepted some invalid… Also affects agentbeat
- CVE-2026-26958 filippo.io/edwards25519 is a Go library implementing the edwards25519 elliptic curve with… Also affects agentbeat
- CVE-2025-68121 During session resumption in crypto/tls, if the underlying Config has its ClientCAs or… Also affects agentbeat
- CVE-2025-61732 A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling… Also affects agentbeat