CVE-2026-24051
HighAdvisory
Published 2 Feb 2026In the index since 5 Sept 2026
- Severity
- High
- worst across findings
- CVSS
- 7.0
- base score, highest
- EPSS
- 0.002
- 6th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 554
- of 17,787 indexed, latest versions
- Container images
- 563
- deployed by those charts
- Fix available
- 1 of 1
- affected package
OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution via PATH Hijacking
Carried by container images the latest versions of 554 of 17,787 indexed charts deploy, on 563 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| go.opentelemetry.io/ | v1.21.0, v1.22.0, v1.23.0, v1.23.1+16 more | 1.40.0 | 563 |
- OSV records
- GHSA-9h8m-3fm2-qjrq
- Also known as
- GO-2026-4394
Charts affected
554 by stars
Container images carrying it
563 by charts deploying them
A fixed version is listed for 1 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| netbirdio/ | 872e3add0e1e | go.opentelemetry.io/ | 1.40.0 | 1 |
| netbirdio/ | a10762533793 | go.opentelemetry.io/ | 1.40.0 | 1 |
| netbirdio/ | d32f82514a24 | go.opentelemetry.io/ | 1.40.0 | 1 |
| netbirdio/ | 46ce5a45538f | go.opentelemetry.io/ | 1.40.0 | 1 |
| netbirdio/ | 67176bcbf6ab | go.opentelemetry.io/ | 1.40.0 | 1 |
| netbirdio/ | e8f392611152 | go.opentelemetry.io/ | 1.40.0 | 1 |
| obolnetwork/ | e263be0a7440 | go.opentelemetry.io/ | 1.40.0 | 1 |
| opencsghq/ | 04121fd19ef9 | go.opentelemetry.io/ | 1.40.0 | 1 |
| opencsghq/ | bdd2c58b9744 | go.opentelemetry.io/ | 1.40.0 | 1 |
| opencsghq/ | de15437db41b | go.opentelemetry.io/ | 1.40.0 | 1 |
| openfga/ | 5e94966c11df | go.opentelemetry.io/ | 1.40.0 | 1 |
| openkruise/ | d3c6d69d2c39 | go.opentelemetry.io/ | 1.40.0 | 1 |
| openkruise/ | 0482722b4e56 | go.opentelemetry.io/ | 1.40.0 | 1 |
| openkruise/ | f81ae78a36a4 | go.opentelemetry.io/ | 1.40.0 | 1 |
| openpolicyagent/ | b7b4d7cfdd52 | go.opentelemetry.io/ | 1.40.0 | 1 |
| opensearchproject/ | f78bbdd1a386 | go.opentelemetry.io/ | 1.40.0 | 1 |
| optimizely/ | 9d0096cabd63 | go.opentelemetry.io/ | 1.40.0 | 1 |
| orbitalreg/ | 45f2620337af | go.opentelemetry.io/ | 1.40.0 | 1 |
| oryd/ | b94007e19a1f | go.opentelemetry.io/ | 1.40.0 | 1 |
| oryd/ | 8f15006a080d | go.opentelemetry.io/ | 1.40.0 | 1 |
| otel/ | 9e36620d6c2c | go.opentelemetry.io/ | 1.40.0 | 1 |
| otel/ | 37fa87091cfa | go.opentelemetry.io/ | 1.40.0 | 1 |
| otel/ | 3bc07732530c | go.opentelemetry.io/ | 1.40.0 | 1 |
| otel/ | 5ac3e0ba2b0b | go.opentelemetry.io/ | 1.40.0 | 1 |
| otel/ | 923eb1cfae32 | go.opentelemetry.io/ | 1.40.0 | 1 |
| otel/ | a7343f018690 | go.opentelemetry.io/ | 1.40.0 | 1 |
| otel/ | faf125d656fa | go.opentelemetry.io/ | 1.40.0 | 1 |
| otel/ | 1e45d9483faa | go.opentelemetry.io/ | 1.40.0 | 1 |
| owncloud/ | 88e7c854517d | go.opentelemetry.io/ | 1.40.0 | 1 |
| owncloud/ | b38fd8fdd58f | go.opentelemetry.io/ | 1.40.0 | 1 |
| percona/ | 6cce2698d3f5 | go.opentelemetry.io/ | 1.40.0 | 1 |
| prom/ | 4f6c47e39a90 | go.opentelemetry.io/ | 1.40.0 | 1 |
| rancher/ | febfd0517838 | go.opentelemetry.io/ | 1.40.0 | 1 |
| rotationalio/ | cc7bb030a20f | go.opentelemetry.io/ | 1.40.0 | 1 |
| ruslanguns/ | 6c77e4675e07 | go.opentelemetry.io/ | 1.40.0 | 1 |
| semaphoreui/ | 3996804607eb | go.opentelemetry.io/ | 1.40.0 | 1 |
| semaphoreui/ | 98ad9bc7a2a0 | go.opentelemetry.io/ | 1.40.0 | 1 |
| semaphoreui/ | e9260bfa8255 | go.opentelemetry.io/ | 1.40.0 | 1 |
| sky5367/ | d51bf68d4b26 | go.opentelemetry.io/ | 1.40.0 | 1 |
| stashapp/ | a534c8afdf39 | go.opentelemetry.io/ | 1.40.0 | 1 |
| supabase/ | ba4ddc594b0b | go.opentelemetry.io/ | 1.40.0 | 1 |
| temporalio/ | 37e2e33dbd7b | go.opentelemetry.io/ | 1.40.0 | 1 |
| temporalio/ | a3a52e6ca122 | go.opentelemetry.io/ | 1.40.0 | 1 |
| temporalio/ | cda4901bab53 | go.opentelemetry.io/ | 1.40.0 | 1 |
| temporalio/ | 5b3502a3b685 | go.opentelemetry.io/ | 1.40.0 | 1 |
| temporalio/ | b44cbfeb43db | go.opentelemetry.io/ | 1.40.0 | 1 |
| temporalio/ | 1e2626efcbc1 | go.opentelemetry.io/ | 1.40.0 | 1 |
| temporalio/ | 8a5798191dea | go.opentelemetry.io/ | 1.40.0 | 1 |
| temporalio/ | c1e3326b2ce1 | go.opentelemetry.io/ | 1.40.0 | 1 |
| udhos/ | 41ab9bae6f3b | go.opentelemetry.io/ | 1.40.0 | 1 |