Raw vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HSummary
CVE-2026-24051 is a high-severity Untrusted Search Path (CWE-426) vulnerability in Opentelemetry Opentelemetry. Its CVSS base score is 7.0 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception by PATH Environment Variable (T1574.007); ranked at the 5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SI-2 (Flaw Remediation) and AC-6 (Least Privilege) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-5303
Vulnerability Data
OpenTelemetry-Go is the Go implementation of OpenTelemetry. The OpenTelemetry Go SDK in version v1.20.0-1.39.0 is vulnerable to Path Hijacking (Untrusted Search Paths) on macOS/Darwin systems. The resource detection code in sdk/resource/host_id.go executes the ioreg system command using a search path.…
more
An attacker with the ability to locally modify the PATH environment variable can achieve Arbitrary Code Execution (ACE) within the context of the application. A fix was released with v1.40.0.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct match to untrusted PATH search leading to local code execution via hijack of ioreg invocation.
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates by requiring prompt application of the vendor fix that stops use of an unqualified ioreg search path.
Limits the impact of arbitrary code execution obtained via PATH hijacking by restricting the privileges under which the instrumented application runs.
Blocks or alerts on execution of attacker-supplied binaries that result from manipulation of the PATH environment variable used by host_id.go.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Preventing execution of unauthorized code directly blocks the malicious binaries that an untrusted search path would load.
Secure development practices include avoiding or sanitizing externally influenced search paths in application code.
Hardened configuration baselines can enforce safe search paths and restrict environment variables that enable the weakness.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can discover search-path issues but does not itself prevent them in production code.
Restricting software installation reduces the chance that untrusted binaries or libraries are placed in search paths.
Secure architecture principles include hard-coded or validated search paths and avoiding reliance on untrusted directories.
Secure coding standards require absolute paths or integrity-checked search paths, directly mitigating CWE-426.
Change-management processes can enforce review of path-handling changes, indirectly lowering risk.