CVE-2026-81870: OpenTelemetry-Go endpoint URL logging in TracerProvider diagnostics

CVE-2026-81870 · Severity: medium · CVSS 4 · Published 2026-09-16

OpenTelemetry Go's internal diagnostic logging can inadvertently expose trace collector endpoint addresses and configuration details when the SDK creates a TracerProvider. If an application enables verbose internal logging and embeds credentials in exporter URLs (particularly with Zipkin), those secrets can appear in application logs where they may be accessed by unauthorized personnel or systems. The default OpenTelemetry logger does not emit this information, so exposure only occurs in non-standard logging configurations.

Technologies: go.opentelemetry.io/otel/sdk (Go), Opentelemetry-Go. Vendors: Go, Opentelemetry.

Quick answers

Is CVE-2026-81870 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-81870 being exploited in the wild.
How severe is CVE-2026-81870?
Medium severity, with a CVSS score of 4, published 16 September 2026.
Which products and versions are affected?
go.opentelemetry.io/otel/exporters/otlp/otlptrace (Go) >= 1.5.0, <= 1.44.0, SEMVER:introduced=1.5.0,fixed=1.45.0; go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc (Go) >= 1.5.0, <= 1.44.0, SEMVER:introduced=1.5.0,fixed=1.45.0; go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp (Go) >= 1.5.0, <= 1.44.0, SEMVER:introduced=1.5.0,fixed=1.45.0; go.opentelemetry.io/otel/exporters/zipkin (Go) >= 1.5.0, <= 1.44.0, SEMVER:introduced=1.5.0,fixed=1.45.0; and 2 more.
Is there a fix for CVE-2026-81870?
Yes. go.opentelemetry.io/otel/exporters/otlp/otlptrace (Go): upgrade to 1.45.0 or later; go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc (Go): upgrade to 1.45.0 or later; go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp (Go): upgrade to 1.45.0 or later; go.opentelemetry.io/otel/exporters/zipkin (Go): upgrade to 1.45.0 or later; go.opentelemetry.io/otel/sdk (Go): upgrade to 1.45.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-81870 attacked?
It is attacked with local access.
Am I affected by CVE-2026-81870?
Check whether you run go.opentelemetry.io/otel/exporters/otlp/otlptrace (Go), go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc (Go), go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • go.opentelemetry.io/otel/exporters/otlp/otlptrace (Go): upgrade to 1.45.0 or later
    go get go.opentelemetry.io/otel/exporters/otlp/otlptrace@v1.45.0
  • go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc (Go): upgrade to 1.45.0 or later
    go get go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc@v1.45.0
  • go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp (Go): upgrade to 1.45.0 or later
    go get go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.45.0
  • go.opentelemetry.io/otel/exporters/zipkin (Go): upgrade to 1.45.0 or later
    go get go.opentelemetry.io/otel/exporters/zipkin@v1.45.0
  • go.opentelemetry.io/otel/sdk (Go): upgrade to 1.45.0 or later
    go get go.opentelemetry.io/otel/sdk@v1.45.0

Technical details

This vulnerability stems from the `MarshalLog` implementations of trace exporters introduced in commit a1fff3c, which recursively log the complete exporter configuration including endpoint URLs and settings. Affected versions (1.5.0–1.44.0) include this data in a `TracerProvider created` internal Info-level event when `sdk/trace.NewTracerProvider` is called. The attack requires an application to enable verbose OpenTelemetry internal logging via `otel.SetLogger()` with appropriate verbosity (V(1) in versions 1.5.0–1.14.x or V(4) in versions 1.15.0–1.44.0), and exposure is limited to credentials embedded in Zipkin collector URLs or OTLP endpoints; OTLP headers and TLS key material are not affected. Remediation is available in version 1.45.0 and later, which logs only exporter types instead of their full configuration.

Affected products

  • OpenTelemetry OpenTelemetry-Go 1.5.0 through 1.44.0

Identifiers

  • CVE-2026-81870
  • GHSA-8wmf-6v46-5gfg
  • GO-2026-6505

Timeline

  • 2026-09-17: disclosed
  • 2026-09-17: patched: Fix available in version 1.45.0

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.