The fix for CVE-2026-24051 improved the Darwin ioreg command but left the BSD kenv command unresolved with a bare command name. A malicious or compromised environment that inserts a rogue location early in the PATH can cause the vulnerable library to invoke an attacker‑supplied executable instead of the intended system command. This enables the execution of arbitrary code with the privileges of the running application and may lead to privilege escalation.

The vulnerability affects the OpenTelemetry-Go library for versions 1.15.0 through 1.42.0 on BSD and Solaris operating systems. Implementations that import and use the opentelemetry-go package in that range are susceptible. This issue has been corrected in version 1.43.0.

The vulnerability carries a CVSS score of 7.3, indicating high severity. The EPSS score of less than 1% suggests a low probability of exploitation in the wild, and the issue is not in the CISA KEV catalog. Exploitation would require a local attacker to alter the PATH environment of a process that includes the affected library, so the attack vector is most likely local. Successful exploitation could compromise confidentiality, integrity, or availability by running arbitrary code.