CVE catalog

CVE-2026-24051

golang-opentelemetry-otel: CVE-2026-24051

Severity: High · CVSS 7CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Published: Feb 2, 2026, 7:49:10 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.18% · Oct 25, 2026

OpenTelemetry-Go is the Go implementation of OpenTelemetry. The OpenTelemetry Go SDK in version v1.20.0-1.39.0 is vulnerable to Path Hijacking (Untrusted Search Paths) on macOS/Darwin systems. The resource detection code in sdk/resource/host_id.go executes the ioreg system command using a search path. An attacker with the ability to locally modify the PATH environment variable can achieve Arbitrary Code Execution (ACE) within the context of the application. A fix was released with v1.40.0.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	golang-opentelemetry-otel	sid	`1.46.0-3`	not affected
Debian	golang-opentelemetry-otel	forky	`1.46.0-2`	not affected
Debian	golang-opentelemetry-otel	trixie	`1.31.0-4`	not affected
Debian	golang-opentelemetry-otel	bookworm	`1.1.0-2`	not affected
Go	go.opentelemetry.io/otel/sdk	Not reported	`1.40.0`	fixed
Cpe	opentelemetry	Not reported	`1.40.0`	fixed
Opensuse	copacetic	tumbleweed	`0.14.0-1.1`	fixed
Opensuse	teleport	tumbleweed	`17.7.23-1.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	golang-opentelemetry-otel	source	sid	`Not affected`	unimportant	Not reported	Not reported
Debian	golang-opentelemetry-otel	source	forky	`Not affected`	unimportant	Not reported	Not reported
Debian	golang-opentelemetry-otel	source	trixie	`Not affected`	unimportant	Not reported	Not reported
Debian	golang-opentelemetry-otel	source	bookworm	`Not affected`	unimportant	Not reported	Not reported
Go	go.opentelemetry.io/otel/sdk	Go	Not reported	`1.40.0`	Not reported	Not reported	Not reported
Cpe	opentelemetry	cpe	Not reported	`1.40.0`	Not reported	NVD-CVE-2026-24051	Not reported
Opensuse	copacetic	rpm	tumbleweed	`0.14.0-1.1`	Not reported	OPENSUSE-SU-2026:10716-1	Not reported
Opensuse	teleport	rpm	tumbleweed	`17.7.23-1.1`	Not reported	OPENSUSE-SU-2026:10684-1	Not reported

OpenFactory catalog packages

[openSUSE Tumbleweed]

[copacetic-bash-completion]Unknown
Source package: [copacetic]
Details (1)
- 0.14.2-1.2 · noarch · tumbleweed
  Unknown · Fixed: 0.14.0-1.1
  Version impact unknown
  dsa · copacetic · opensuse · tumbleweed
[copacetic-fish-completion]Unknown
Source package: [copacetic]
Details (1)
- 0.14.2-1.2 · noarch · tumbleweed
  Unknown · Fixed: 0.14.0-1.1
  Version impact unknown
  dsa · copacetic · opensuse · tumbleweed
[copacetic-zsh-completion]Unknown
Source package: [copacetic]
Details (1)
- 0.14.2-1.2 · noarch · tumbleweed
  Unknown · Fixed: 0.14.0-1.1
  Version impact unknown
  dsa · copacetic · opensuse · tumbleweed
[teleport-bash-completion]Unknown
Source package: [teleport]
Details (1)
- 17.7.26-1.3 · noarch · tumbleweed
  Unknown · Fixed: 17.7.23-1.1
  Version impact unknown
  dsa · teleport · opensuse · tumbleweed
[teleport-fdpass-teleport]Unknown
Source package: [teleport]
Details (1)
- 17.7.26-1.3 · x86_64 · tumbleweed
  Unknown · Fixed: 17.7.23-1.1
  Version impact unknown
  dsa · teleport · opensuse · tumbleweed
[teleport-tbot]Unknown
Source package: [teleport]
Details (1)
- 17.7.26-1.3 · x86_64 · tumbleweed
  Unknown · Fixed: 17.7.23-1.1
  Version impact unknown
  dsa · teleport · opensuse · tumbleweed
[teleport-tbot-bash-completion]Unknown
Source package: [teleport]
Details (1)
- 17.7.26-1.3 · noarch · tumbleweed
  Unknown · Fixed: 17.7.23-1.1
  Version impact unknown
  dsa · teleport · opensuse · tumbleweed
[teleport-tbot-zsh-completion]Unknown
Source package: [teleport]
Details (1)
- 17.7.26-1.3 · noarch · tumbleweed
  Unknown · Fixed: 17.7.23-1.1
  Version impact unknown
  dsa · teleport · opensuse · tumbleweed
[teleport-tctl]Unknown
Source package: [teleport]
Details (1)
- 17.7.26-1.3 · x86_64 · tumbleweed
  Unknown · Fixed: 17.7.23-1.1
  Version impact unknown
  dsa · teleport · opensuse · tumbleweed
[teleport-tctl-bash-completion]Unknown
Source package: [teleport]
Details (1)
- 17.7.26-1.3 · noarch · tumbleweed
  Unknown · Fixed: 17.7.23-1.1
  Version impact unknown
  dsa · teleport · opensuse · tumbleweed
[teleport-tctl-zsh-completion]Unknown
Source package: [teleport]
Details (1)
- 17.7.26-1.3 · noarch · tumbleweed
  Unknown · Fixed: 17.7.23-1.1
  Version impact unknown
  dsa · teleport · opensuse · tumbleweed
[teleport-tsh]Unknown
Source package: [teleport]
Details (1)
- 17.7.26-1.3 · x86_64 · tumbleweed
  Unknown · Fixed: 17.7.23-1.1
  Version impact unknown
  dsa · teleport · opensuse · tumbleweed
[teleport-tsh-bash-completion]Unknown
Source package: [teleport]
Details (1)
- 17.7.26-1.3 · noarch · tumbleweed
  Unknown · Fixed: 17.7.23-1.1
  Version impact unknown
  dsa · teleport · opensuse · tumbleweed
[teleport-tsh-zsh-completion]Unknown
Source package: [teleport]
Details (1)
- 17.7.26-1.3 · noarch · tumbleweed
  Unknown · Fixed: 17.7.23-1.1
  Version impact unknown
  dsa · teleport · opensuse · tumbleweed
[teleport-zsh-completion]Unknown
Source package: [teleport]
Details (1)
- 17.7.26-1.3 · noarch · tumbleweed
  Unknown · Fixed: 17.7.23-1.1
  Version impact unknown
  dsa · teleport · opensuse · tumbleweed
[copacetic]Fixed
Source package: [copacetic]
Details (1)
- 0.14.2-1.2 · x86_64 · tumbleweed
  Fixed · Fixed: 0.14.0-1.1
  dsa · copacetic · opensuse · tumbleweed
[teleport]Fixed
Source package: [teleport]
Details (1)
- 17.7.26-1.3 · x86_64 · tumbleweed
  Fixed · Fixed: 17.7.23-1.1
  dsa · teleport · opensuse · tumbleweed

[Debian 12 (Bookworm)]

[golang-opentelemetry-otel-dev]Not affected
Source package: [golang-opentelemetry-otel]
Details (2)
- 1.1.0-2 · all · bookworm
  Not affected
  dsa · golang-opentelemetry-otel · debian · bookworm
- 1.1.0-2 · all · bookworm
  Not affected
  dsa · golang-opentelemetry-otel · debian · bookworm

Observed: Oct 24, 2026, 1:06:28 AM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [Go Vulnerability Database] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]