CVE-2026-24051: 
cAdvisor vulnerability analysis and mitigation

CVE-2026-24051 is a path hijacking (Untrusted Search Path) vulnerability in the OpenTelemetry Go SDK affecting macOS/Darwin systems. The flaw exists in versions >= 1.21.0 and < 1.40.0 of the go.opentelemetry.io/otel/sdk package, where resource detection code in sdk/resource/host_id.go invokes the ioreg system command without specifying its full path. A local attacker with the ability to modify the PATH environment variable can redirect execution to a malicious binary, achieving arbitrary code execution within the application's context. It was published on February 2, 2026, with a CVSS v3.1 base score of 7.0 (High) (GitHub Advisory, OTel Security Advisory).

The root cause is classified as CWE-426 (Untrusted Search Path): the hostIDReaderDarwin struct in sdk/resource/host_id.go calls execCommand("ioreg", "-rd1", "-c", "IOPlatformExpertDevice") using only the bare command name rather than the absolute path /usr/sbin/ioreg. On macOS/Darwin, this causes the Go runtime to resolve ioreg via the PATH environment variable at execution time. An attacker who can prepend a directory they control to PATH and place a malicious executable named ioreg there will have it executed instead of the legitimate system binary whenever the SDK's WithHostID resource detector runs. The attack requires low privileges and no user interaction, but has high complexity because the attacker must be able to influence the process environment or place a malicious file in a PATH-accessible location (GitHub Advisory, Fix Commit).

Successful exploitation allows a local attacker to execute arbitrary code within the security context of the vulnerable application, resulting in high impact to confidentiality, integrity, and availability. An attacker could read sensitive application data, tamper with application state or outputs, or cause a denial of service. The scope is limited to the affected application process (unchanged scope), but in environments where the application runs with elevated privileges or has access to sensitive data (e.g., IBM Cloud Pak for Data, IBM Maximo Application Suite, IBM watsonx Orchestrate, Splunk Enterprise), the blast radius could be significant (GitHub Advisory, IBM Advisory).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation as of the time of disclosure (GitHub Advisory). The EPSS score is approximately 0.006% (very low probability of exploitation within 30 days). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. The attack complexity is rated High, as exploitation requires the ability to control or influence the PATH environment variable of the target process, which typically implies some prior foothold on the system.

1. Gain local access: Obtain low-privilege local access to a macOS/Darwin system running an application that uses the OpenTelemetry Go SDK versions 1.21.0–1.39.0 with the WithHostID resource detector enabled.
2. Identify the target process: Confirm the application invokes the WithHostID detector (part of go.opentelemetry.io/otel/sdk/resource), which triggers execution of the ioreg command during resource detection at startup or periodically.
3. Create a malicious binary: Write a malicious executable named ioreg (e.g., a shell script or compiled binary that spawns a reverse shell, exfiltrates data, or establishes persistence) and place it in a directory the attacker controls, such as /tmp/evil/.
4. Manipulate the PATH: Modify the PATH environment variable for the target process to prepend the attacker-controlled directory: export PATH=/tmp/evil:$PATH. This can be done by modifying shell profile files, process environment, or through another vulnerability that allows environment manipulation.
5. Trigger resource detection: Cause the application to invoke the WithHostID resource detector — typically this occurs at application startup. The SDK calls execCommand("ioreg", ...), which resolves to /tmp/evil/ioreg instead of /usr/sbin/ioreg.
6. Achieve code execution: The malicious ioreg binary executes within the application's security context, enabling arbitrary code execution, data exfiltration, or further lateral movement (GitHub Advisory, Fix Commit).

• Process: Unexpected process named ioreg spawned from a non-standard path (i.e., not /usr/sbin/ioreg); child processes of the Go application that are unusual (e.g., shells, network tools like curl, nc, python).
• File System: Presence of an executable named ioreg in non-standard directories (e.g., /tmp/, user home directories, or any directory prepended to PATH); unexpected new files or scripts created by the application process.
• Logs: Application logs showing errors or unexpected output from the ioreg command; OS audit logs (e.g., macOS Unified Log / log show) recording execution of ioreg from a path other than /usr/sbin/ioreg.
• Environment: Unusual modifications to PATH environment variables in shell profile files (.bashrc, .zshrc, .profile) or launch agent/daemon property lists on macOS.

The fix is to upgrade the go.opentelemetry.io/otel/sdk package to version 1.40.0 or later, which specifies the absolute path /usr/sbin/ioreg instead of the bare command name, eliminating the PATH search entirely (Fix Commit, GitHub Advisory). For organizations unable to patch immediately, the following mitigations reduce risk:

• Restrict local user access to systems running affected applications, applying the principle of least privilege.
• Ensure application processes run in controlled environments where PATH cannot be modified by untrusted users.
• Monitor for unexpected ioreg executables in non-standard directories.
• Downstream products (IBM Cloud Pak for Data, IBM Maximo Application Suite, IBM watsonx Orchestrate, Splunk Enterprise) should apply vendor-specific patches as they become available (IBM Advisory, Splunk Advisory).

Multiple major vendors have issued security bulletins acknowledging the impact of CVE-2026-24051 on their products that bundle the OpenTelemetry Go SDK, including IBM (Cloud Pak for Data, Maximo Application Suite, watsonx Orchestrate, QRadar AQL Plugin) and Splunk Enterprise (IBM Advisory, Splunk Advisory). Microsoft also referenced the CVE in its security update guide (MSRC). The vulnerability was reported by security researcher MorielHarush and coordinated by the OpenTelemetry maintainer arminru, with remediation developed by pellared (OTel Security Advisory). Broader community reaction has been limited given the local-only attack vector and lack of public exploit code.