# CVE-2026-81870: OpenTelemetry-Go endpoint URL logging in TracerProvider diagnostics

Source: https://junglewise.ai/threats/cve-2026-81870-opentelemetry-go-endpoint-url-logging-in-tracerprovider  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-16. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-81870 · Severity: medium · CVSS 4 · Published 2026-09-16

OpenTelemetry Go's internal diagnostic logging can inadvertently expose trace collector endpoint addresses and configuration details when the SDK creates a TracerProvider. If an application enables verbose internal logging and embeds credentials in exporter URLs (particularly with Zipkin), those secrets can appear in application logs where they may be accessed by unauthorized personnel or systems. The default OpenTelemetry logger does not emit this information, so exposure only occurs in non-standard logging configurations.

Technologies: [go.opentelemetry.io/otel/sdk (Go)](https://junglewise.ai/threats/technologies/go-opentelemetry-io-otel-sdk), [Opentelemetry-Go](https://junglewise.ai/threats/technologies/opentelemetry-go). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Opentelemetry](https://junglewise.ai/threats/vendors/opentelemetry).

## Quick answers

**Is CVE-2026-81870 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-81870 being exploited in the wild.

**How severe is CVE-2026-81870?** Medium severity, with a CVSS score of 4, published 16 September 2026.

**Which products and versions are affected?** go.opentelemetry.io/otel/exporters/otlp/otlptrace (Go) >= 1.5.0, <= 1.44.0, SEMVER:introduced=1.5.0,fixed=1.45.0; go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc (Go) >= 1.5.0, <= 1.44.0, SEMVER:introduced=1.5.0,fixed=1.45.0; go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp (Go) >= 1.5.0, <= 1.44.0, SEMVER:introduced=1.5.0,fixed=1.45.0; go.opentelemetry.io/otel/exporters/zipkin (Go) >= 1.5.0, <= 1.44.0, SEMVER:introduced=1.5.0,fixed=1.45.0; and 2 more.

**Is there a fix for CVE-2026-81870?** Yes. go.opentelemetry.io/otel/exporters/otlp/otlptrace (Go): upgrade to 1.45.0 or later; go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc (Go): upgrade to 1.45.0 or later; go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp (Go): upgrade to 1.45.0 or later; go.opentelemetry.io/otel/exporters/zipkin (Go): upgrade to 1.45.0 or later; go.opentelemetry.io/otel/sdk (Go): upgrade to 1.45.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-81870 attacked?** It is attacked with local access.

**Am I affected by CVE-2026-81870?** Check whether you run go.opentelemetry.io/otel/exporters/otlp/otlptrace (Go), go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc (Go), go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- go.opentelemetry.io/otel/exporters/otlp/otlptrace (Go): upgrade to 1.45.0 or later

  ```sh
  go get go.opentelemetry.io/otel/exporters/otlp/otlptrace@v1.45.0
  ```

- go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc (Go): upgrade to 1.45.0 or later

  ```sh
  go get go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc@v1.45.0
  ```

- go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp (Go): upgrade to 1.45.0 or later

  ```sh
  go get go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.45.0
  ```

- go.opentelemetry.io/otel/exporters/zipkin (Go): upgrade to 1.45.0 or later

  ```sh
  go get go.opentelemetry.io/otel/exporters/zipkin@v1.45.0
  ```

- go.opentelemetry.io/otel/sdk (Go): upgrade to 1.45.0 or later

  ```sh
  go get go.opentelemetry.io/otel/sdk@v1.45.0
  ```


## Technical details

This vulnerability stems from the `MarshalLog` implementations of trace exporters introduced in commit a1fff3c, which recursively log the complete exporter configuration including endpoint URLs and settings. Affected versions (1.5.0–1.44.0) include this data in a `TracerProvider created` internal Info-level event when `sdk/trace.NewTracerProvider` is called. The attack requires an application to enable verbose OpenTelemetry internal logging via `otel.SetLogger()` with appropriate verbosity (V(1) in versions 1.5.0–1.14.x or V(4) in versions 1.15.0–1.44.0), and exposure is limited to credentials embedded in Zipkin collector URLs or OTLP endpoints; OTLP headers and TLS key material are not affected. Remediation is available in version 1.45.0 and later, which logs only exporter types instead of their full configuration.

## Affected products

- OpenTelemetry OpenTelemetry-Go 1.5.0 through 1.44.0

## Identifiers

- CVE-2026-81870
- GHSA-8wmf-6v46-5gfg
- GO-2026-6505

## Timeline

- 2026-09-17: disclosed
- 2026-09-17: patched: Fix available in version 1.45.0

## Related threats

- [OpenTelemetry-Go BatchingProcessor CPU exhaustion via log emission](https://junglewise.ai/threats/cve-2026-81872-opentelemetry-go-batchingprocessor-cpu-exhaustion-via-log)
- [OpenTelemetry-Go OTLP log gRPC exporter TLS certificate validation bypass](https://junglewise.ai/threats/cve-2026-81871-opentelemetry-go-otlp-log-grpc-exporter-tls-certificate)
- [OpenTelemetry-Go attribute truncation bypass with Unicode replacement character](https://junglewise.ai/threats/cve-2026-81869-opentelemetry-go-attribute-truncation-bypass-with-unicode)
- [OpenTelemetry-Go unsynchronized baggage map race condition](https://junglewise.ai/threats/cve-2026-45404-opentelemetry-go-unsynchronized-baggage-map-race-condition)
- [OpenTelemetry OpenTelemetry-Go untrusted search path in host ID detection](https://junglewise.ai/threats/cve-2026-39883-opentelemetry-opentelemetry-go-untrusted-search-path-in-host-id)