CVE-2026-24051
HighAdvisory
Published 2 Feb 2026In the index since 5 Sept 2026
- Severity
- High
- worst across findings
- CVSS
- 7.0
- base score, highest
- EPSS
- 0.002
- 6th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 554
- of 17,787 indexed, latest versions
- Container images
- 563
- deployed by those charts
- Fix available
- 1 of 1
- affected package
OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution via PATH Hijacking
Carried by container images the latest versions of 554 of 17,787 indexed charts deploy, on 563 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| go.opentelemetry.io/ | v1.21.0, v1.22.0, v1.23.0, v1.23.1+16 more | 1.40.0 | 563 |
- OSV records
- GHSA-9h8m-3fm2-qjrq
- Also known as
- GO-2026-4394
Charts affected
554 by stars
Container images carrying it
563 by charts deploying them
A fixed version is listed for 1 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| ghcr.io/ | 72dc058e478d | go.opentelemetry.io/ | 1.40.0 | 1 |
| ghcr.io/ | 167fd532bd43 | go.opentelemetry.io/ | 1.40.0 | 1 |
| ghcr.io/ | 73a2ebae4413 | go.opentelemetry.io/ | 1.40.0 | 1 |
| ghcr.io/ | f312f50ddc57 | go.opentelemetry.io/ | 1.40.0 | 1 |
| ghcr.io/ | b40439329191 | go.opentelemetry.io/ | 1.40.0 | 1 |
| ghcr.io/ | 58bed8d1e7fc | go.opentelemetry.io/ | 1.40.0 | 1 |
| ghcr.io/ | f22cae0e6cf3 | go.opentelemetry.io/ | 1.40.0 | 1 |
| ghcr.io/ | 3475404bef5c | go.opentelemetry.io/ | 1.40.0 | 1 |
| ghcr.io/ | 0cbced8e6240 | go.opentelemetry.io/ | 1.40.0 | 1 |
| ghcr.io/ | 2a19792ad2ec | go.opentelemetry.io/ | 1.40.0 | 1 |
| ghcr.io/ | 0cca6760763a | go.opentelemetry.io/ | 1.40.0 | 1 |
| ghcr.io/ | 560a16a56d4e | go.opentelemetry.io/ | 1.40.0 | 1 |
| ghcr.io/ | ae179f65d869 | go.opentelemetry.io/ | 1.40.0 | 1 |
| ghcr.io/ | 06ed5db6cd33 | go.opentelemetry.io/ | 1.40.0 | 1 |
| ghcr.io/ | b914032ef9ad | go.opentelemetry.io/ | 1.40.0 | 1 |
| ghcr.io/ | a61c7022abcf | go.opentelemetry.io/ | 1.40.0 | 1 |
| ghcr.io/ | 832a32779e6d | go.opentelemetry.io/ | 1.40.0 | 1 |
| ghcr.io/ | 63f7eaf5aa8a | go.opentelemetry.io/ | 1.40.0 | 1 |
| ghcr.io/ | c62e3347611c | go.opentelemetry.io/ | 1.40.0 | 1 |
| ghcr.io/ | 8b99a8104a2f | go.opentelemetry.io/ | 1.40.0 | 1 |
| ghcr.io/ | 528f2174fa2f | go.opentelemetry.io/ | 1.40.0 | 1 |
| ghcr.io/ | d3fb171f20e1 | go.opentelemetry.io/ | 1.40.0 | 1 |
| ghcr.io/ | dd8a35d50c2d | go.opentelemetry.io/ | 1.40.0 | 1 |
| ghcr.io/ | fa6dba122171 | go.opentelemetry.io/ | 1.40.0 | 1 |
| ghcr.io/ | 5dfa86b6451f | go.opentelemetry.io/ | 1.40.0 | 1 |
| ghcr.io/ | 90097a08b87c | go.opentelemetry.io/ | 1.40.0 | 1 |
| ghcr.io/ | 45e744fc623f | go.opentelemetry.io/ | 1.40.0 | 1 |
| ghcr.io/ | f65f6810ea23 | go.opentelemetry.io/ | 1.40.0 | 1 |
| ghcr.io/ | b065ec5a5239 | go.opentelemetry.io/ | 1.40.0 | 1 |
| ghcr.io/ | e6239e2838d7 | go.opentelemetry.io/ | 1.40.0 | 1 |
| ghcr.io/ | a424948c8143 | go.opentelemetry.io/ | 1.40.0 | 1 |
| ghcr.io/ | fa1f6b2e9a6e | go.opentelemetry.io/ | 1.40.0 | 1 |
| ghcr.io/ | 7fbc6855c8b3 | go.opentelemetry.io/ | 1.40.0 | 1 |
| ghcr.io/ | 2fd2678f07ef | go.opentelemetry.io/ | 1.40.0 | 1 |
| ghcr.io/ | 9c7bc0f9bb35 | go.opentelemetry.io/ | 1.40.0 | 1 |
| ghcr.io/ | c379e66246be | go.opentelemetry.io/ | 1.40.0 | 1 |
| ghcr.io/ | def57d85a2da | go.opentelemetry.io/ | 1.40.0 | 1 |
| ghcr.io/ | 80f3a0a51af5 | go.opentelemetry.io/ | 1.40.0 | 1 |
| ghcr.io/ | 2e6e09fa77dd | go.opentelemetry.io/ | 1.40.0 | 1 |
| ghcr.io/ | fe7ce555a12d | go.opentelemetry.io/ | 1.40.0 | 1 |
| ghcr.io/ | b61c750ade19 | go.opentelemetry.io/ | 1.40.0 | 1 |
| ghcr.io/ | 5bc5ca66d55a | go.opentelemetry.io/ | 1.40.0 | 1 |
| ghcr.io/ | d7f93d2182fe | go.opentelemetry.io/ | 1.40.0 | 1 |
| ghcr.io/ | c0c8d53df9f3 | go.opentelemetry.io/ | 1.40.0 | 1 |
| ghcr.io/ | 67d587cc2c39 | go.opentelemetry.io/ | 1.40.0 | 1 |
| ghcr.io/ | a7ea52f87446 | go.opentelemetry.io/ | 1.40.0 | 1 |
| ghcr.io/ | 2434560e8f0e | go.opentelemetry.io/ | 1.40.0 | 1 |
| ghcr.io/ | 457bb5ada68b | go.opentelemetry.io/ | 1.40.0 | 1 |
| ghcr.io/ | 008b9b662289 | go.opentelemetry.io/ | 1.40.0 | 1 |
| ghcr.io/ | 380eccdc29e9 | go.opentelemetry.io/ | 1.40.0 | 1 |