Executive brief
OpenTelemetry Go's internal diagnostic logging can inadvertently expose trace collector endpoint addresses and configuration details when the SDK creates a TracerProvider. If an application enables verbose internal logging and embeds credentials in exporter URLs (particularly with Zipkin), those secrets can appear in application logs where they may be accessed by unauthorized personnel or systems. The default OpenTelemetry logger does not emit this information, so exposure only occurs in non-standard logging configurations.
Technical details
This vulnerability stems from the `MarshalLog` implementations of trace exporters introduced in commit a1fff3c, which recursively log the complete exporter configuration including endpoint URLs and settings. Affected versions (1.5.0–1.44.0) include this data in a `TracerProvider created` internal Info-level event when `sdk/trace.NewTracerProvider` is called. The attack requires an application to enable verbose OpenTelemetry internal logging via `otel.SetLogger()` with appropriate verbosity (V(1) in versions 1.5.0–1.14.x or V(4) in versions 1.15.0–1.44.0), and exposure is limited to credentials embedded in Zipkin collector URLs or OTLP endpoints; OTLP headers and TLS key material are not affected. Remediation is available in version 1.45.0 and later, which logs only exporter types instead of their full configuration.
Affected products
- OpenTelemetry OpenTelemetry-Go 1.5.0 through 1.44.0
Timeline
- 2026-09-17: disclosed
- 2026-09-17: patched: Fix available in version 1.45.0