Skip to content
OpenAdvisories
High · 7.0 CVE-2026-24051 EUVD-2026-5303GHSA-9h8m-3fm2-qjrqGO-2026-4394

OpenTelemetry-Go Affected by Arbitrary Code Execution via PATH Hijacking

Published Feb 2, 2026 · Updated Feb 3, 2026 · Assigned by GitHub_M

Vendor: open-telemetry Product: opentelemetry-go Package: argo-workflow-controller-4.0 Package: argo-workflow-executor-4.0 Package: argo-workflows-4.0 Package: argocd-image-updater Package: aws-node-termination-handler Package: aws-otel-collector Package: azcopy Package: azl-otel-collector Package: azure-service-operator Package: azure-workload-identity-webhook Package: azuredisk-csi-1.34 Package: azurefile-csi-1.35 Package: bank-vaults Package: bank-vaults-template Package: blob-csi-1.27 Package: boring-registry Package: buildctl Package: buildkitd Package: calico-apiserver-3.31 Package: calico-kube-controllers-3.31 Package: cass-operator Package: cerbos Package: cerbosctl Package: cert-manager-webhook-pdns Package: cloud-provider-aws-1.31-cloud-controller-manager Package: cloud-provider-aws-1.35-cloud-controller-manager Package: cloud-provider-azure-cloud-controller-manager-1.35 Package: cloud-provider-azure-cloud-node-manager-1.35 Package: cloud-provider-vsphere Package: cloudprober Package: cluster-api-1.12-capd-manager Package: cluster-api-1.12-controller Package: cluster-api-1.12-kubeadm-control-plane-controller Package: cluster-api-azure-controller Package: cluster-api-gcp-controller Package: cluster-api-helm-controller Package: cluster-api-ipam-provider-in-cluster Package: cluster-api-provider-vsphere Package: conftest Package: containerd-1 Package: containerd-2 Package: coredns-1.13 Package: coredns-1.14 Package: cortex Package: cosign Package: cri-o Package: cri-tools Package: crictl Package: dagdotdev Package: dagger Package: datadog-agent-7.72 Package: datadog-agent-7.73 Package: datadog-cluster-agent-7.72 Package: datadog-cluster-agent-7.73 Package: datadog-operator Package: descheduler Package: dgraph Package: dkron Package: docker-cli-buildx Package: docker-compose Package: dockerd-29 Package: envoy-gateway Package: envoy-gateway-egctl Package: etcd-3.6 Package: falcoctl Package: falcosidekick Package: ferretdb Package: fluent-bit-plugin-loki Package: fluent-operator Package: flyte Package: fulcio Package: gcsfuse Package: gitaly-18.6 Package: gitaly-18.7 Package: gitaly-18.8 Package: gitaly-backup-18.6 Package: gitaly-backup-18.7 Package: gitaly-backup-18.8 Package: gitlab-kas-18.6 Package: gitlab-runner-18.9 Package: gitlab-runner-helper-18.9 Package: go.opentelemetry.io/otel/sdk Package: gogatekeeper Package: gomplate-5 Package: grafana-12.3 Package: grafana-image-renderer Package: grafana-mimir-3.0-metaconvert-3.0 Package: grafana-mimir-3.0-mimirtool-3.0 Package: grafana-mimir-3.0-query-tee-3.0 Package: grype Package: headlamp Package: helm-operator Package: hydra Package: istio-cni-1.29 Package: istio-install-cni-1.29 Package: istio-pilot-agent-1.25 Package: istio-pilot-agent-1.29 Package: istio-pilot-discovery-1.29 Package: istioctl-1.29 Package: jaeger-operator Package: jitsucom-bulker-sidecar Package: juicefs-1.3 Package: k3d Package: k3s Package: k3s-1.32 Package: k3s-static Package: k3s-static-1.32 Package: k6 Package: k8s_gateway Package: k8sgpt Package: k9s Package: kaniko Package: kapp-controller Package: kata-containers-preview Package: keda-2.19 Package: keda-2.19-metrics-apiserver Package: kiali Package: kine Package: kserve-agent Package: kserve-manager Package: kserve-router Package: ksops Package: kube-arangodb-1.4 Package: kube-metrics-adapter Package: kube-vip-cloud-provider Package: kubeadm-1.35 Package: kubectl-1.32 Package: kubernetes-1.35 Package: kubernetes-csi-external-attacher Package: kubernetes-csi-external-health-monitor Package: kubernetes-csi-external-provisioner Package: kubernetes-csi-external-resizer Package: kubescape Package: kubescape-operator Package: kubevela-vela-core Package: kuma-cp-2.12 Package: kuma-dp-2.12 Package: kwok Package: kyverno-1.17 Package: kyverno-background-controller-1.17 Package: kyverno-cleanup-controller-1.17 Package: kyverno-cli-1.17 Package: kyverno-init-container-1.17 Package: kyverno-notation-aws Package: kyverno-reports-controller-1.17 Package: litestream Package: metrics-server Package: migrate Package: minio Package: node-feature-discovery-0.18 Package: octo-sts Package: octo-sts-webhook Package: op-geth Package: opencost Package: opentofu-1.11 Package: opentofu-1.9 Package: otel-cli Package: percona-server-mongodb-operator Package: podinfo Package: policy-controller Package: policy-controller-tester Package: prometheus-3.8 Package: prometheus-3.9 Package: prometheus-adapter Package: prometheus-alertmanager Package: pulumi-kubernetes-operator Package: rancher-system-agent Package: ratify Package: ratify-licensechecker Package: ratify-sbom Package: ratify-schemavalidator Package: ratify-vulnerabilityreport Package: rekor-server Package: restic Package: rke2-cloud-provider Package: scorecard Package: seaweedfs Package: secrets-store-csi-driver-provider-gcp Package: sftpgo Package: sftpgo-plugin-kms Package: sftpgo-plugin-pubsub Package: skaffold Package: sops Package: spicedb Package: spicedb-operator Package: spire-server Package: src Package: steampipe Package: syft Package: task Package: tekton-chains Package: teleport-18.6 Package: teleport-18.6-kube-agent-updater Package: teleport-18.6-operator Package: temporal Package: temporal-cassandra-tool Package: temporal-server Package: terraform-provider-google Package: terraform-provider-grafana Package: terragrunt Package: tflint Package: tfsec Package: thanos Package: tkn Package: traefik-3.6 Package: trillian-logserver Package: trillian-logsigner Package: trivy Package: trivy-operator Package: vault-env Package: vault-secrets-webhook Package: vcluster Package: vcluster-cli Package: vcluster-syncer Package: velero Package: vitess-23 Package: vitess-23-binaries Package: weaviate Package: witness Package: zarf Package: zot Ecosystem: Azure Linux Ecosystem: Go Ecosystem: Wolfi

Description

OpenTelemetry-Go is the Go implementation of OpenTelemetry. The OpenTelemetry Go SDK in version v1.20.0-1.39.0 is vulnerable to Path Hijacking (Untrusted Search Paths) on macOS/Darwin systems. The resource detection code in sdk/resource/host_id.go executes the ioreg system command using a search path. An attacker with the ability to locally modify the PATH environment variable can achieve Arbitrary Code Execution (ACE) within the context of the application. A fix was released with v1.40.0.

Affected products

VendorProductAffectedFixed
open-telemetry opentelemetry-go >= 1.21.0, < 1.40.0 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed copacetic 0.14.0-1.1 openSUSE-SU-2026:10716-1
openSUSE Tumbleweed kyverno 1.17.2-1.1 openSUSE-SU-2026:10613-1
openSUSE Tumbleweed openbao 2.5.1-1.1 openSUSE-SU-2026:10396-1
openSUSE Tumbleweed teleport 17.7.23-1.1 openSUSE-SU-2026:10684-1
openSUSE Leap 16.0 govulncheck-vulndb 0.0.20260723T184607-160000.1.1 openSUSE-SU-2026:21483-1
openSUSE Leap 15.6 govulncheck-vulndb 0.0.20260226T182644-150000.1.149.1 SUSE-SU-2026:0757-1

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 cri-o +2 No fix yet —

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling argo-workflows-4.0 +2 4.0.1-r3 —
Wolfi rolling argocd-image-updater 1.1.1-r2 —
Wolfi rolling aws-node-termination-handler 1.25.4-r3 —
Wolfi rolling aws-otel-collector 0.47.0-r2 —
Wolfi rolling azcopy 10.32.1-r1 —
Wolfi rolling azure-service-operator 2.18.0-r2 —
Wolfi rolling azure-workload-identity-webhook 1.5.1-r8 —
Wolfi rolling azuredisk-csi-1.34 1.34.1-r2 —
Wolfi rolling azurefile-csi-1.35 1.35.0-r2 —
Wolfi rolling bank-vaults +1 1.32.1-r3 —
Wolfi rolling blob-csi-1.27 1.27.2-r2 —
Wolfi rolling boring-registry 0.16.6-r9 —
Wolfi rolling buildctl +1 0.27.1-r5 —
Wolfi rolling calico-apiserver-3.31 +1 3.31.4-r1 —
Wolfi rolling cass-operator +5 1.29.0-r1 —
Wolfi rolling cerbos +1 0.51.0-r5 —
Wolfi rolling cert-manager-webhook-pdns 2.5.3-r8 —
Wolfi rolling cloud-provider-aws-1.31-cloud-controller-manager 1.31.9-r4 —
Wolfi rolling cloud-provider-azure-cloud-node-manager-1.35 +2 1.35.0-r1 —
Wolfi rolling cloud-provider-vsphere 1.35.0-r4 —
Wolfi rolling cloudprober 0.14.1-r6 —
Wolfi rolling cluster-api-1.12-controller +2 1.12.3-r2 —
Wolfi rolling cluster-api-azure-controller 1.22.0-r2 —
Wolfi rolling cluster-api-gcp-controller 1.11.0-r1 —
Wolfi rolling cluster-api-helm-controller 0.6.0-r2 —
Wolfi rolling cluster-api-ipam-provider-in-cluster 1.1.0-r3 —
Wolfi rolling cluster-api-provider-vsphere 1.15.2-r3 —
Wolfi rolling conftest 0.66.0-r3 —
Wolfi rolling containerd-1 1.7.30-r3 —
Wolfi rolling containerd-2 2.2.1-r3 —
Wolfi rolling coredns-1.14 1.14.1-r3 —
Wolfi rolling cortex 1.20.1-r3 —
Wolfi rolling cosign 3.0.5-r1 —
Wolfi rolling crictl +1 1.35.0-r3 —
Wolfi rolling dagdotdev 0.0.20-r5 —
Wolfi rolling dagger 0.20.0-r1 —
Wolfi rolling datadog-agent-7.72 +1 7.72.4-r15 —
Wolfi rolling datadog-agent-7.73 +1 7.73.3-r7 —
Wolfi rolling datadog-operator 1.23.1-r1 —
Wolfi rolling descheduler 0.35.0-r1 —
Wolfi rolling dgraph 25.2.0-r4 —
Wolfi rolling dkron 4.0.9-r3 —
Wolfi rolling docker-cli-buildx 0.31.1-r4 —
Wolfi rolling docker-compose 5.1.0-r2 —
Wolfi rolling dockerd-29 29.2.1-r4 —
Wolfi rolling envoy-gateway +1 1.7.0-r2 —
Wolfi rolling etcd-3.6 3.6.8-r1 —
Wolfi rolling falcoctl 0.12.2-r2 —
Wolfi rolling falcosidekick 2.32.0-r6 —
Wolfi rolling fluent-bit-plugin-loki 3.6.7-r1 —
Wolfi rolling fluent-operator 3.6.0-r2 —
Wolfi rolling flyte 1.16.4-r1 —
Wolfi rolling fulcio 1.8.5-r5 —
Wolfi rolling gcsfuse 2.12.2-r12 —
Wolfi rolling gitaly-18.6 +5 No fix yet —
Wolfi rolling gitaly-18.7 +1 18.7.5-r1 —
Wolfi rolling gitaly-18.8 +1 18.8.5-r1 —
Wolfi rolling gitlab-runner-18.9 +1 18.9.0-r1 —
Wolfi rolling gogatekeeper 4.6.0-r1 —
Wolfi rolling gomplate-5 5.0.0-r6 —
Wolfi rolling grafana-12.3 12.3.4-r2 —
Wolfi rolling grafana-image-renderer 5.6.0-r1 —
Wolfi rolling grafana-mimir-3.0-mimirtool-3.0 +2 3.0.4-r0 —
Wolfi rolling grype 0.109.0-r2 —
Wolfi rolling headlamp 0.40.1-r1 —
Wolfi rolling helm-operator 1.42.0-r6 —
Wolfi rolling hydra 25.4.0-r7 —
Wolfi rolling jaeger-operator 1.65.0-r14 —
Wolfi rolling jitsucom-bulker-sidecar 2.11.913-r7 —
Wolfi rolling juicefs-1.3 1.3.1-r7 —
Wolfi rolling k3d 5.8.3-r22 —
Wolfi rolling k3s +1 1.35.1.1-r2 —
Wolfi rolling k3s-1.32 +1 1.32.12.1-r1 —
Wolfi rolling k6 1.6.1-r1 —
Wolfi rolling k8s_gateway 1.6.4-r1 —
Wolfi rolling k8sgpt 0.4.30-r1 —
Wolfi rolling k9s 0.50.18-r5 —
Wolfi rolling kaniko 1.25.10-r1 —
Wolfi rolling kapp-controller 0.59.2-r1 —
Wolfi rolling keda-2.19 +1 2.19.0-r1 —
Wolfi rolling kiali 2.22.0-r1 —
Wolfi rolling kine 0.14.12-r2 —
Wolfi rolling kserve-agent +2 0.16.0-r14 —
Wolfi rolling ksops 4.4.0-r8 —
Wolfi rolling kube-arangodb-1.4 1.4.1-r2 —
Wolfi rolling kube-metrics-adapter 0.2.8-r1 —
Wolfi rolling kube-vip-cloud-provider 0.0.12-r10 —
Wolfi rolling kubeadm-1.35 +1 1.35.2-r1 —
Wolfi rolling kubectl-1.32 1.32.13-r4 —
Wolfi rolling kubernetes-csi-external-attacher 4.11.0-r1 —
Wolfi rolling kubernetes-csi-external-health-monitor 0.17.0-r1 —
Wolfi rolling kubernetes-csi-external-provisioner 6.2.0-r0 —
Wolfi rolling kubernetes-csi-external-resizer 2.1.0-r1 —
Wolfi rolling kubescape 4.0.2-r2 —
Wolfi rolling kubescape-operator 0.2.128-r1 —
Wolfi rolling kubevela-vela-core 1.10.7-r2 —
Wolfi rolling kuma-cp-2.12 +1 2.12.3-r6 —
Wolfi rolling kwok 0.7.0-r9 —
Wolfi rolling kyverno-1.17 +5 1.17.1-r2 —
Wolfi rolling kyverno-notation-aws 1.1-r37 —
Wolfi rolling litestream 0.5.17-r3 —
Wolfi rolling metrics-server 0.8.1-r2 —
Wolfi rolling migrate 4.19.1-r4 —
Wolfi rolling minio 0.20251015.172955-r6 —
Wolfi rolling node-feature-discovery-0.18 0.18.3-r7 —
Wolfi rolling octo-sts +1 0.5.4-r4 —
Wolfi rolling op-geth 1.101701.0-r2 —
Wolfi rolling opencost 1.119.2-r2 —
Wolfi rolling opentofu-1.11 1.11.5-r2 —
Wolfi rolling opentofu-1.9 1.9.4-r8 —
Wolfi rolling otel-cli 0.4.5-r12 —
Wolfi rolling percona-server-mongodb-operator 1.22.0-r1 —
Wolfi rolling podinfo 6.10.1-r2 —
Wolfi rolling policy-controller +1 0.14.0-r3 —
Wolfi rolling prometheus-3.9 3.9.1-r7 —
Wolfi rolling prometheus-adapter 0.12.0-r21 —
Wolfi rolling prometheus-alertmanager 0.31.1-r1 —
Wolfi rolling pulumi-kubernetes-operator 2.5.0-r2 —
Wolfi rolling rancher-system-agent 0.3.14-r6 —
Wolfi rolling ratify +4 1.4.0-r13 —
Wolfi rolling rekor-server 1.5.0-r4 —
Wolfi rolling restic 0.18.1-r8 —
Wolfi rolling rke2-cloud-provider 1.34.2-r5 —
Wolfi rolling scorecard 5.4.0-r8 —
Wolfi rolling seaweedfs 4.13-r2 —
Wolfi rolling secrets-store-csi-driver-provider-gcp 1.11.0-r3 —
Wolfi rolling sftpgo +1 2.7.0-r6 —
Wolfi rolling sftpgo-plugin-kms 1.0.16-r6 —
Wolfi rolling sftpgo-plugin-pubsub 1.0.15-r5 —
Wolfi rolling skaffold 2.17.2-r2 —
Wolfi rolling sops 3.12.1-r2 —
Wolfi rolling spicedb 1.49.1-r2 —
Wolfi rolling spicedb-operator 1.22.0-r3 —
Wolfi rolling spire-server 1.14.1-r6 —
Wolfi rolling src 7.0.0-r2 —
Wolfi rolling steampipe 2.3.6-r1 —
Wolfi rolling syft 1.42.1-r2 —
Wolfi rolling task 3.48.0-r3 —
Wolfi rolling tekton-chains 0.26.2-r1 —
Wolfi rolling teleport-18.6 +2 18.6.8-r2 —
Wolfi rolling temporal 1.6.0-r2 —
Wolfi rolling temporal-server +1 1.29.3-r2 —
Wolfi rolling terraform-provider-google 7.21.0-r1 —
Wolfi rolling terraform-provider-grafana 4.25.0-r2 —
Wolfi rolling terragrunt 0.99.3-r3 —
Wolfi rolling tflint 0.61.0-r1 —
Wolfi rolling tfsec 1.28.14-r15 —
Wolfi rolling thanos 0.41.0-r1 —
Wolfi rolling tkn 0.44.0-r1 —
Wolfi rolling traefik-3.6 3.6.9-r1 —
Wolfi rolling trillian-logserver +1 1.7.2-r11 —
Wolfi rolling trivy 0.69.1-r3 —
Wolfi rolling trivy-operator 0.30.0-r1 —
Wolfi rolling vault-env 1.22.1-r3 —
Wolfi rolling vault-secrets-webhook 1.22.2-r4 —
Wolfi rolling vcluster +2 0.32.0-r2 —
Wolfi rolling velero 1.17.2-r3 —
Wolfi rolling vitess-23 +1 23.0.3-r1 —
Wolfi rolling weaviate 1.36.2-r1 —
Wolfi rolling witness 0.10.2-r9 —
Wolfi rolling zarf 0.73.0-r2 —
Wolfi rolling zot 2.1.14-r5 —

Affected packages

EcosystemPackageAffectedFixedRecord
Go go.opentelemetry.io/otel/sdk >= 1.21.0, < 1.40.0 1.40.0 GHSA-9h8m-3fm2-qjrq

Advisories 8

References