{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0"}],"component":"github.com/digitalocean/droplet-agent","cve_ids":["CVE-2026-24516"],"ecosystem":"Go","epss":0.02599,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-fh3m-562m-w4f6","id":"tcs_01M5KF97CSEZ8A9W87HH6K34EQ","modified_at":"2026-03-26T21:11:24.608061Z","published_at":"2026-03-23T18:30:31Z","references":["https://osv.dev/vulnerability/GHSA-fh3m-562m-w4f6","https://nvd.nist.gov/vuln/detail/CVE-2026-24516","https://github.com/digitalocean/droplet-agent","https://github.com/digitalocean/droplet-agent/blob/main/internal/troubleshooting/actioner/actioner.go","https://github.com/digitalocean/droplet-agent/blob/main/internal/troubleshooting/command/command.go","https://github.com/digitalocean/droplet-agent/blob/main/internal/troubleshooting/command/exec.go","https://github.com/poxsky/CVE-2026-24516-DigitalOcean-RCE"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"GHSA-fh3m-562m-w4f6","url":"https://osv.dev/vulnerability/GHSA-fh3m-562m-w4f6"}],"summary":"DigitalOcean Droplet Agent: Command Injection via Metadata Service Endpoint"}