Search: CVE-2026-24051

CVE-2026-24051 is a high-severity vulnerability affecting the OpenTelemetry-Go SDK versions 1.21.0 up to but not including 1.40.0 on macOS/Darwin systems. The vulnerability arises from an untrusted search path (CWE-426) in the resource detection code that executes the 'ioreg' system command without specifying an absolute path. An attacker with local access who can modify the PATH environment variable can hijack this command execution to run arbitrary code within the application's context. This flaw allows for arbitrary code execution without user interaction but requires local privileges and a high attack complexity. No known exploits are currently reported in the wild. The issue was fixed in version 1.