OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs
Priority MEDIUM 44CWE-200Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Partial Red Hat: 1 fixed, 1 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-200.
Summary
OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.5.0 to 1.44.0, sdk/trace.NewTracerProvider emits a TracerProvider created internal Info-level diagnostic event whose MarshalLog implementations recursively include span processor, exporter, and client configuration. Applications that call otel.SetLogger to enable OpenTelemetry internal Info logging can therefore record OTLP gRPC and HTTP collector endpoints, the OTLP HTTP Insecure flag, and complete Zipkin collector URLs. A person or system with access to those logs can learn internal collector topology and can recover credentials or tokens embedded in Zipkin URL user information or query strings. The default OpenTelemetry logger does not emit the event, and this path does not log OTLP authentication headers, TLS key material, or span payloads. This issue is fixed in version 1.45.0.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00266 18th percentileScored 2026-11-07
Fix Partial opentelemetry-go (open-telemetry): 1.45.0go.opentelemetry.io/otel/sdk (Go): 1.45.0+4 more productsRed Hat: 2 advisoriesRed Hat: 1 fixed, 1 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| open-telemetry | opentelemetry-go | 1.5.0 to before 1.45.0 | 1.45.0 | Patch available | CNA |
| — | go.opentelemetry.io/otel/sdk (Go) | 1.5.0 to before 1.45.0 | 1.45.0 | Patch available | GHSA-8wmf-6v46-5gfg |
| — | go.opentelemetry.io/otel/exporters/otlp/otlptrace (Go) | 1.5.0 to before 1.45.0 | 1.45.0 | Patch available | GHSA-8wmf-6v46-5gfg |
| — | go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc (Go) | 1.5.0 to before 1.45.0 | 1.45.0 | Patch available | GHSA-8wmf-6v46-5gfg |
| — | go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp (Go) | 1.5.0 to before 1.45.0 | 1.45.0 | Patch available | GHSA-8wmf-6v46-5gfg |
| — | go.opentelemetry.io/otel/exporters/zipkin (Go) | 1.5.0 to before 1.45.0 | 1.45.0 | Patch available | GHSA-8wmf-6v46-5gfg |
- opentelemetry-go Vendoropen-telemetry Affected 1.5.0 to before 1.45.0 Fixed in 1.45.0 Patch available CNA
- go.opentelemetry.io/otel/sdk (Go) Vendor— Affected 1.5.0 to before 1.45.0 Fixed in 1.45.0 Patch available GHSA-8wmf-6v46-5gfg
- go.opentelemetry.io/otel/exporters/otlp/otlptrace (Go) Vendor— Affected 1.5.0 to before 1.45.0 Fixed in 1.45.0 Patch available GHSA-8wmf-6v46-5gfg
- go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc (Go) Vendor— Affected 1.5.0 to before 1.45.0 Fixed in 1.45.0 Patch available GHSA-8wmf-6v46-5gfg
- go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp (Go) Vendor— Affected 1.5.0 to before 1.45.0 Fixed in 1.45.0 Patch available GHSA-8wmf-6v46-5gfg
- go.opentelemetry.io/otel/exporters/zipkin (Go) Vendor— Affected 1.5.0 to before 1.45.0 Fixed in 1.45.0 Patch available GHSA-8wmf-6v46-5gfg
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:opentelemetry:opentelemetry:*:*:*:*:*:*:*:* | — | — | open-telemetry |
- cpe:2.3:a:opentelemetry:opentelemetry:*:*:*:*:*:*:*:* Versions — — ·open-telemetry
Remediation
- Fix · CNA opentelemetry-go (open-telemetry) Fixed in 1.45.0
- Fix · GHSA-8wmf-6v46-5gfg go.opentelemetry.io/otel/sdk (Go) Fixed in 1.45.0 Advisory →
- Fix · GHSA-8wmf-6v46-5gfg go.opentelemetry.io/otel/exporters/otlp/otlptrace (Go) Fixed in 1.45.0 Advisory →
- Fix · GHSA-8wmf-6v46-5gfg go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc (Go) Fixed in 1.45.0 Advisory →
- Fix · GHSA-8wmf-6v46-5gfg go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp (Go) Fixed in 1.45.0 Advisory →
- Fix · GHSA-8wmf-6v46-5gfg go.opentelemetry.io/otel/exporters/zipkin (Go) Fixed in 1.45.0 Advisory →
Red Hat 2 advisories
- RHSA-2026:72475 Released 2026-09-28 · Red Hat rating Importantcert-manager Operator for Red Hat OpenShift 1.20.1
- Cert Manager support for Red Hat OpenShift release 1.20 registry.redhat.io/cert-manager/cert-manager-istio-csr-rhel9
- RHSA-2026:72395 Released 2026-09-28 · Red Hat rating Importantcert-manager Operator for Red Hat OpenShift 1.20.1
- Cert Manager support for Red Hat OpenShift release 1.20 registry.redhat.io/cert-manager/cert-manager-istio-csr-rhel9
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet: Fix deferred |
| Cert Manager support for Red Hat OpenShift release 1.20 | Fixed | RHSA-2026:72395, RHSA-2026:72475 |
Timeline
- 2026-10-02 Threatist record created from CVE-2026-81870
- 2026-10-03 Alias added: GHSA-8wmf-6v46-5gfg
- 2026-11-07 Affected versions changed · Red Hat
References
Other 6
- https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-8wmf-6v46-5gfg
- https://github.com/open-telemetry/opentelemetry-go/pull/8438
- https://github.com/open-telemetry/opentelemetry-go/commit/3a1412d2b3bc4e4231fbeac2ed42117ae541bb38
- https://github.com/open-telemetry/opentelemetry-go/releases/tag/exporters/zipkin/v1.45.0
- https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/v1.45.0
- https://github.com/open-telemetry/opentelemetry-go
More open-telemetry vulnerabilities
- TI-2024-23957 OpenTelemetry Collector has a Denial of Service via Zip/Decompression Bomb sent over HTTP or gRPC CVSS 3.1HIGH 8.2
- TI-2026-42706 OpenTelemetry JavaScript: Denial of service in `JaegerPropagator` via unhandled exception on a malformed header CVSS 3.1HIGH 7.5
- TI-2026-33428 OpenTelemetry eBPF Instrumentation: Memcached payload length overflow can crash OBI CVSS 3.1HIGH 7.5
- TI-2026-33427 OpenTelemetry eBPF Instrumentation: MongoDB parser panics on malformed wire messages CVSS 3.1HIGH 7.5
- TI-2026-33420 OpenTelemetry eBPF Instrumentation: Postgres BIND parsing can panic on malformed payloads CVSS 3.1HIGH 7.5
- TI-2026-32777 opentelemetry-js: Prometheus exporter process crash via malformed HTTP request CVSS 3.1HIGH 7.5
Sources
- CVE-2026-81870 · CVE Program
- CVE-2026-81870 · NVD
- FIRST EPSS
- GHSA-8wmf-6v46-5gfg · GitHub Advisory Database · CC BY 4.0
- CVE-2026-81870 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences