Skip to content
OpenAdvisories

Product · open-telemetry

opentelemetry-go

11 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 7.3
    CVE-2026-39883 Public exploit

    OpenTelemetry-Go has an incomplete fix for CVE-2026-24051: BSD kenv command not using absolute path enables PATH hijacking

    OpenTelemetry-Go is the Go implementation of OpenTelemetry. From 1.15.0 to 1.42.0, the fix for CVE-2026-24051 changed the Darwin ioreg command to use an absolute path but left the BSD kenv command using a bare name, allowing the same PATH hijacking attack on …

    open-telemetry opentelemetry-go zot kubescape Ubuntu Wolfi Go
  • High 7.5
    CVE-2026-29181

    OpenTelemetry-Go multi-value `baggage` header extraction causes excessive allocations (remote dos amplification)

    OpenTelemetry-Go is the Go implementation of OpenTelemetry. From 1.36.0 to 1.40.0, multi-value baggage: header extraction parses each header field-value independently and aggregates members across values. This allows an attacker to amplify cpu and allocations…

    open-telemetry opentelemetry-go k3d aactl Ubuntu Azure Linux Wolfi Go
  • High 7.0
    CVE-2026-24051

    OpenTelemetry-Go Affected by Arbitrary Code Execution via PATH Hijacking

    OpenTelemetry-Go is the Go implementation of OpenTelemetry. The OpenTelemetry Go SDK in version v1.20.0-1.39.0 is vulnerable to Path Hijacking (Untrusted Search Paths) on macOS/Darwin systems. The resource detection code in sdk/resource/host_id.go executes th…

    open-telemetry opentelemetry-go zot kubescape Azure Linux Wolfi Go