fix(cve): CVE-2026-24051 - bump go.opentelemetry.io/otel to v1.40.0 [release-v0.43.1]

[divyansh42]

CVE Details

Field	Value
CVE ID	CVE-2026-24051
GHSA	GHSA-9h8m-3fm2-qjrq
Severity	HIGH
CVSS Score	7.3
Affected Package	go.opentelemetry.io/otel/sdk/resource
Vulnerable Range	>= 1.21.0, <= 1.39.0
Fix Version	1.40.0

Fix Summary

Bumps all go.opentelemetry.io/otel packages from v1.39.0 → v1.40.0:

• go.opentelemetry.io/otel
• go.opentelemetry.io/otel/metric
• go.opentelemetry.io/otel/sdk
• go.opentelemetry.io/otel/sdk/metric
• go.opentelemetry.io/otel/trace

The vulnerability (GHSA-9h8m-3fm2-qjrq) allows Arbitrary Code Execution via local PATH Hijacking on macOS/Darwin through kenv in otel/sdk/resource. v1.40.0 is the minimum patched version.

Test Results

⚠️ No automated tests run — dependency bump only. Manual verification recommended.

Breaking Changes

None expected. v1.40.0 is a minor version bump with backwards-compatible API changes.

Risk Assessment

Low — indirect dependency upgrade within the same major version. The vulnerability is OS-specific (macOS/Darwin) and exploitable only via local PATH manipulation.

Jira References

SRVKP-10615

Verification Steps

• Confirm go.opentelemetry.io/otel packages are at v1.40.0 in go.mod
• Run go mod verify to confirm all modules verified
• Confirm no build failures

🤖 Generated with Claude Code via Ambient CVE Fixer

[tekton-robot]

@divyansh42: Adding the "do-not-merge/release-note-label-needed" label because no release-note block was detected, please follow our release note process to remove it.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[tekton-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
To complete the pull request process, please assign piyush-garg after the PR has been reviewed.
You can assign the PR to them by writing /assign @piyush-garg in a comment when ready.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[divyansh42]

/retest

[linux-foundation-easycla]

• ❌ The email address for the commit (cb8ea73) is not linked to the GitHub account, preventing the EasyCLA check. Consult this Help Article and GitHub Help to resolve. (To view the commit's email address, add .patch at the end of this PR page's URL.) For further assistance with EasyCLA, please visit our EasyCLA portal and chat with our support bot.