{"id":"EUVD-2026-5303","revision":"35b05719345e4b9b92f0482b8f34059e","records":[{"revision":"35b05719345e4b9b92f0482b8f34059e","observedAt":"2026-10-30T02:54:45.58+00:00","statement":{"source":"euvd","id":"EUVD-2026-5303","aliases":["CVE-2026-24051","GHSA-9h8m-3fm2-qjrq"],"title":"OpenTelemetry-Go is the Go implementation of OpenTelemetry. The OpenTelemetry Go SDK in version v1.20.0-1.39.0 is vulnerable to Path Hijacking (Untrusted Search Paths) on macOS/Darwin systems. The resource detection code in sdk/resource/hos…","description":"OpenTelemetry-Go is the Go implementation of OpenTelemetry. The OpenTelemetry Go SDK in version v1.20.0-1.39.0 is vulnerable to Path Hijacking (Untrusted Search Paths) on macOS/Darwin systems. The resource detection code in sdk/resource/host_id.go executes the ioreg system command using a search path. An attacker with the ability to locally modify the PATH environment variable can achieve Arbitrary Code Execution (ACE) within the context of the application. A fix was released with v1.40.0.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7,"severity":null}],"references":["https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-9h8m-3fm2-qjrq","https://github.com/open-telemetry/opentelemetry-go/commit/d45961bcda453fcbdb6469c22d6e88a1f9970a53"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-5303","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Feb 2, 2026, 7:49:10 PM","dateUpdated":"Feb 3, 2026, 2:54:41 PM"},"relatedAdvisories":[{"id":"openSUSE-SU-2026:10716-1","title":"copacetic-0.14.0-1.1 on GA media","vulnerabilityIds":["CVE-2026-24051"]},{"id":"openSUSE-SU-2026:10396-1","title":"openbao-2.5.1-1.1 on GA media","vulnerabilityIds":["CVE-2025-68121","CVE-2026-24051"]},{"id":"openSUSE-SU-2026:10613-1","title":"kyverno-1.17.2-1.1 on GA media","vulnerabilityIds":["CVE-2026-1229","CVE-2026-24051","CVE-2026-33186","CVE-2026-34986","CVE-2026-4789"]},{"id":"msrc_CVE-2026-24051","title":"OpenTelemetry-Go Affected by Arbitrary Code Execution via PATH Hijacking","vulnerabilityIds":["CVE-2026-24051"]},{"id":"openSUSE-SU-2026:10684-1","title":"teleport-17.7.23-1.1 on GA media","vulnerabilityIds":["CVE-2025-15558","CVE-2026-24051","CVE-2026-34165","CVE-2026-4427"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-5303","identifiers":["EUVD-2026-5303","CVE-2026-24051","GHSA-9h8m-3fm2-qjrq"]},"retained":false,"historicalAffected":[]}],"coverage":[]}