Go/github.com/digitalocean/droplet-agent CVE-2026-24516: unknown, EPSS 2.60%
DigitalOcean Droplet Agent: Command Injection via Metadata Service Endpoint in github.com/digitalocean/droplet-agent
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | - |
Fixed versions
No fixed version in the source.
Sources
- osv: GO-2026-4854
- https://github.com/advisories/GHSA-fh3m-562m-w4f6
- https://nvd.nist.gov/vuln/detail/CVE-2026-24516
- https://github.com/digitalocean/droplet-agent/blob/main/internal/troubleshooting/actioner/actioner.go
- https://github.com/digitalocean/droplet-agent/blob/main/internal/troubleshooting/command/command.go
- https://github.com/digitalocean/droplet-agent/blob/main/internal/troubleshooting/command/exec.go
- https://github.com/poxsky/CVE-2026-24516-DigitalOcean-RCE
CVE-2026-24516 · published · modified · JSON