CVE-2026-24051
HighAdvisory
Published 2 Feb 2026In the index since 5 Sept 2026
- Severity
- High
- worst across findings
- CVSS
- 7.0
- base score, highest
- EPSS
- 0.002
- 6th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 554
- of 17,787 indexed, latest versions
- Container images
- 563
- deployed by those charts
- Fix available
- 1 of 1
- affected package
OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution via PATH Hijacking
Carried by container images the latest versions of 554 of 17,787 indexed charts deploy, on 563 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| go.opentelemetry.io/ | v1.21.0, v1.22.0, v1.23.0, v1.23.1+16 more | 1.40.0 | 563 |
- OSV records
- GHSA-9h8m-3fm2-qjrq
- Also known as
- GO-2026-4394
Charts affected
554 by stars
Container images carrying it
563 by charts deploying them
A fixed version is listed for 1 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| infisical/ | ff38294270e3 | go.opentelemetry.io/ | 1.40.0 | 1 |
| instill/ | b53eaa51c523 | go.opentelemetry.io/ | 1.40.0 | 1 |
| instill/ | ebe12f77a3f9 | go.opentelemetry.io/ | 1.40.0 | 1 |
| instill/ | e980125e5ba5 | go.opentelemetry.io/ | 1.40.0 | 1 |
| istio/ | ab34c4740f44 | go.opentelemetry.io/ | 1.40.0 | 1 |
| istio/ | ce27c9ce43c8 | go.opentelemetry.io/ | 1.40.0 | 1 |
| istio/ | 325156535773 | go.opentelemetry.io/ | 1.40.0 | 1 |
| istio/ | 9c3d6a218181 | go.opentelemetry.io/ | 1.40.0 | 1 |
| istio/ | f8b0e412ac4a | go.opentelemetry.io/ | 1.40.0 | 1 |
| jaegertracing/ | 60e65bfffe1f | go.opentelemetry.io/ | 1.40.0 | 1 |
| jaegertracing/ | f6b5d09073f1 | go.opentelemetry.io/ | 1.40.0 | 1 |
| jaegertracing/ | e128b9adbb29 | go.opentelemetry.io/ | 1.40.0 | 1 |
| jaegertracing/ | 3f036ec60e61 | go.opentelemetry.io/ | 1.40.0 | 1 |
| jamesorlakin/ | 3894dc11b236 | go.opentelemetry.io/ | 1.40.0 | 1 |
| kazem26/ | 268b7c6a59dd | go.opentelemetry.io/ | 1.40.0 | 1 |
| kong/ | 03510967482b | go.opentelemetry.io/ | 1.40.0 | 1 |
| kubegreen/ | 2dc0f0a6034c | go.opentelemetry.io/ | 1.40.0 | 1 |
| kubeovn/ | 6722b54eb5c0 | go.opentelemetry.io/ | 1.40.0 | 1 |
| kubeshop/ | d8e1af6aca99 | go.opentelemetry.io/ | 1.40.0 | 1 |
| kubeshop/ | def0d0f0d4ab | go.opentelemetry.io/ | 1.40.0 | 1 |
| kubevip/ | f8f4e3401f76 | go.opentelemetry.io/ | 1.40.0 | 1 |
| l7mp/ | 2f8114477ba6 | go.opentelemetry.io/ | 1.40.0 | 1 |
| l7mp/ | c34f7c931491 | go.opentelemetry.io/ | 1.40.0 | 1 |
| langgenius/ | 8269050f192e | go.opentelemetry.io/ | 1.40.0 | 1 |
| layer5/ | 78a8be21bef3 | go.opentelemetry.io/ | 1.40.0 | 1 |
| library/ | b4e3952384eb | go.opentelemetry.io/ | 1.40.0 | 1 |
| library/ | 2a232a42256f | go.opentelemetry.io/ | 1.40.0 | 1 |
| library/ | 851f91d24121 | go.opentelemetry.io/ | 1.40.0 | 1 |
| library/ | aa3df78ecf32 | go.opentelemetry.io/ | 1.40.0 | 1 |
| library/ | dd43b430341a | go.opentelemetry.io/ | 1.40.0 | 1 |
| library/ | 104204dadedf | go.opentelemetry.io/ | 1.40.0 | 1 |
| lightstep/ | c800e05e1eff | go.opentelemetry.io/ | 1.40.0 | 1 |
| linuxserver/ | bf03578ef731 | go.opentelemetry.io/ | 1.40.0 | 1 |
| linuxserver/ | dca67384e3e9 | go.opentelemetry.io/ | 1.40.0 | 1 |
| logiqai/ | 65b996bc7bdc | go.opentelemetry.io/ | 1.40.0 | 1 |
| louislam/ | 059b49d64739 | go.opentelemetry.io/ | 1.40.0 | 1 |
| louislam/ | 3d632903e6af | go.opentelemetry.io/ | 1.40.0 | 1 |
| louislam/ | 4c364ef96aad | go.opentelemetry.io/ | 1.40.0 | 1 |
| louislam/ | 96510915e6be | go.opentelemetry.io/ | 1.40.0 | 1 |
| louislam/ | 9865163f92c1 | go.opentelemetry.io/ | 1.40.0 | 1 |
| louislam/ | bc6f244ecf27 | go.opentelemetry.io/ | 1.40.0 | 1 |
| megaease/ | fad1c7452958 | go.opentelemetry.io/ | 1.40.0 | 1 |
| milvusdb/ | fededb2f2d63 | go.opentelemetry.io/ | 1.40.0 | 1 |
| minio/ | 14b7076ca85a | go.opentelemetry.io/ | 1.40.0 | 1 |
| minio/ | 46b3009bf704 | go.opentelemetry.io/ | 1.40.0 | 1 |
| minio/ | d249d1fb6966 | go.opentelemetry.io/ | 1.40.0 | 1 |
| netapp/ | 06f6c9a0653f | go.opentelemetry.io/ | 1.40.0 | 1 |
| netbirdio/ | 0c9994b393ea | go.opentelemetry.io/ | 1.40.0 | 1 |
| netbirdio/ | 52682e5f48f9 | go.opentelemetry.io/ | 1.40.0 | 1 |
| netbirdio/ | b0adc4ad4ec6 | go.opentelemetry.io/ | 1.40.0 | 1 |