Information Disclosure in OpenTelemetry-Go by OpenTelemetry

CVE-2026-81870

What is CVE-2026-81870?

OpenTelemetry-Go, designed for standard telemetry data collection, contains an information disclosure vulnerability present in versions 1.5.0 to 1.44.0. The problem arises in the tracing component where internal diagnostic logs, when enabled through the logger configuration, may inadvertently expose sensitive configuration details including OTLP gRPC and HTTP collector endpoints, alongside credentials embedded within Zipkin URLs. This leakage can potentially provide hostile entities with insights into the internal collector arrangements, thus posing a risk for credential and token recovery from exposed log data. The vulnerability has been addressed in version 1.45.0.

References