CVE-2026-24051: opentelemetry from 1.21.0 (inclusive), before 1.40.0 (exclusive); +1 more affected products

CVE-2026-24051 affects azl3 ignition-flatcar 2.22.0-1 on Azure Linux 3.0. CVSS 3.1 base score 7.0 (HIGH, Vendor/CNA). EPSS 0.00179 (percentile 0.07063), scored 22-Oct-2026. Fixed version: v1.39.0-aikido.3. Fixed version: v1.38.0-aikido.2. Fixed version: v1.35.0-aikido.2. Fixed version: v1.28.0-aikido.3. Fixed version: v1.30.0-aikido.1. Fixed version: v1.36.0-aikido.1. Fixed version: v1.24.0-aikido.1. Fixed version: v1.28.0-root.io.1. Fixed version: v1.35.0-root.io.1. Fixed version: v1.39.0-root.io.1. Fixed version: v1.39.0-root.io.2. Fixed version: v1.38.0-root.io.2.

Affected technology

opentelemetry · from 1.21.0 (inclusive), before 1.40.0 (exclusive)
opentelemetry

opentelemetry-go · >= 1.21.0, < 1.40.0
open-telemetry

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Local · Low privileges required · No user interaction required

What an attacker can do

An attacker with the ability to locally modify the PATH environment variable can achieve Arbitrary Code Execution (ACE) within the context of the application. Vendor/CNA’s CVSS 3.1 assessment (base score 7.0/10) rates confidentiality, integrity and availability impact as high.

Published 23-Oct-2026 16:11 UTC

CWE: CWE-426
Product: azl3 ignition-flatcar 2.22.0-1 on Azure Linux 3.0
CCR priority: 28.0 /100 (P4)
CVSS 3.1: 7.0 /10 · CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H · Vendor/CNA
EPSS: 0.00179 · percentile 0.07063 · 2026-10-22
KEV: no

Provenance

FIRST EPSS daily exploit-probability · Source record · observed 2026-10-23 06:11:59.600832+00:00 UTC
Microsoft MSRC Security Update Guide (CVRF) · Source record · observed 2026-10-04 07:08:49.022374+00:00 UTC
NVD CVE API 2.0 · Source record · observed 2026-10-19 12:24:32.001504+00:00 UTC
OSV.dev · Source record · observed 2026-10-23 07:49:27.727257+00:00 UTC

Stable permalink: https://cybercodered.org/item/cve-cve-2026-24051.html