Skip to content
Heist/ feed
LowFix available

OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs

Type: advisorySource: OSV2 source records

### Summary OpenTelemetry Go versions 1.5.0 through 1.44.0 can include trace exporter endpoint configuration in an internal diagnostic log emitted when an SDK `TracerProvider` is created. The default OpenTelemetry logger does not emit this event. Exposure requires an application to install a logger that enables OpenTelemetry's internal Info-level diagnostics and for someone other than the intended audience to have access to those logs. The logged configuration can disclose the address of the trace collector and whether the OTLP/HTTP connection is configured as insecure. The Zipkin exporter logs its complete collector URL, so credentials in URL userinfo or tokens in the query string are also disclosed if an application embeds them there. OTLP authentication headers, TLS key material, and exported span data are not included in this log. Exporter `MarshalLog` implementations that caused this configuration to be included in internal logs were introduced by [`a1fff3c`](https://github.com/open-telemetry/opentelemetry-go/commit/a1fff3c2588c783d1f3f6fd2315aa2660fc6d330). ### Details When `sdk/trace.NewTracerProvider` constructs a provider, it records a `TracerProvider created` internal Info event containing the provider configuration. In affected versions, the configuration's `MarshalLog` methods recursively include: 1. the provider's span processors; 2. each processor's span exporter; and 3. for the OTLP trace exporter, its client configuration. This causes the following values to b

Announced Group revision 1
Original source ↗

GHSA-8wmf-6v46-5gfg

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:GHSA-8wmf-6v46-5gfg

go.opentelemetry.io/otel/sdk

Source reference: /affected/0/package/name

Affected versions
Not stated in this record
Fixed versions
1.45.0

Source reference: /affected/0/ranges

Prerequisites
Not stated in this record

go.opentelemetry.io/otel/exporters/otlp/otlptrace

Source reference: /affected/1/package/name

Affected versions
Not stated in this record
Fixed versions
1.45.0

Source reference: /affected/1/ranges

Prerequisites
Not stated in this record

go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc

Source reference: /affected/2/package/name

Affected versions
Not stated in this record
Fixed versions
1.45.0

Source reference: /affected/2/ranges

Prerequisites
Not stated in this record

go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp

Source reference: /affected/3/package/name

Affected versions
Not stated in this record
Fixed versions
1.45.0

Source reference: /affected/3/ranges

Prerequisites
Not stated in this record

go.opentelemetry.io/otel/exporters/zipkin

Source reference: /affected/4/package/name

Affected versions
Not stated in this record
Fixed versions
1.45.0

Source reference: /affected/4/ranges

Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "SEMVER",
        "events": [
          {
            "introduced": "1.5.0"
          },
          {
            "fixed": "1.45.0"
          }
        ]
      }
    ],
    "package": {
      "name": "go.opentelemetry.io/otel/sdk",
      "purl": "pkg:golang/go.opentelemetry.io/otel/sdk",
      "ecosystem": "Go"
    },
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-8wmf-6v46-5gfg/GHSA-8wmf-6v46-5gfg.json",
      "last_known_affected_version_range": "<= 1.44.0"
    }
  },
  {
    "ranges": [
      {
        "type": "SEMVER",
        "events": [
          {
            "introduced": "1.5.0"
          },
          {
            "fixed": "1.45.0"
          }
        ]
      }
    ],
    "package": {
      "name": "go.opentelemetry.io/otel/exporters/otlp/otlptrace",
      "purl": "pkg:golang/go.opentelemetry.io/otel/exporters/otlp/otlptrace",
      "ecosystem": "Go"
    },
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-8wmf-6v46-5gfg/GHSA-8wmf-6v46-5gfg.json",
      "last_known_affected_version_range": "<= 1.44.0"
    }
  },
  {
    "ranges": [
      {
        "type": "SEMVER",
        "events": [
          {
            "introduced": "1.5.0"
          },
          {
            "fixed": "1.45.0"
          }
        ]
      }
    ],
    "package": {
      "name": "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc",
      "purl": "pkg:golang/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc",
      "ecosystem": "Go"
    },
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-8wmf-6v46-5gfg/GHSA-8wmf-6v46-5gfg.json",
      "last_known_affected_version_range": "<= 1.44.0"
    }
  },
  {
    "ranges": [
      {
        "type": "SEMVER",
        "events": [
          {
            "introduced": "1.5.0"
          },
          {
            "fixed": "1.45.0"
          }
        ]
      }
    ],
    "package": {
      "name": "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp",
      "purl": "pkg:golang/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp",
      "ecosystem": "Go"
    },
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-8wmf-6v46-5gfg/GHSA-8wmf-6v46-5gfg.json",
      "last_known_affected_version_range": "<= 1.44.0"
    }
  },
  {
    "ranges": [
      {
        "type": "SEMVER",
        "events": [
          {
            "introduced": "1.5.0"
          },
          {
            "fixed": "1.45.0"
          }
        ]
      }
    ],
    "package": {
      "name": "go.opentelemetry.io/otel/exporters/zipkin",
      "purl": "pkg:golang/go.opentelemetry.io/otel/exporters/zipkin",
      "ecosystem": "Go"
    },
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-8wmf-6v46-5gfg/GHSA-8wmf-6v46-5gfg.json",
      "last_known_affected_version_range": "<= 1.44.0"
    }
  }
]
Related CVEs
CVE-2026-81870

Source reference: /aliases

Publisher severity

low

Source reference: /database_specific/severity

Event
#63908 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement

GO-2026-6505

Revision 2

OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs in go.opentelemetry.io/otel/exporters/otlp/otlptrace

OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs in go.opentelemetry.io/otel/exporters/otlp/otlptrace

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:GO-2026-6505

go.opentelemetry.io/otel/exporters/otlp/otlptrace

Source reference: /affected/0/package/name

Affected versions
Not stated in this record
Fixed versions
1.45.0

Source reference: /affected/0/ranges

Prerequisites
Not stated in this record

go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc

Source reference: /affected/1/package/name

Affected versions
Not stated in this record
Fixed versions
1.45.0

Source reference: /affected/1/ranges

Prerequisites
Not stated in this record

go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp

Source reference: /affected/2/package/name

Affected versions
Not stated in this record
Fixed versions
1.45.0

Source reference: /affected/2/ranges

Prerequisites
Not stated in this record

go.opentelemetry.io/otel/exporters/zipkin

Source reference: /affected/3/package/name

Affected versions
Not stated in this record
Fixed versions
1.45.0

Source reference: /affected/3/ranges

Prerequisites
Not stated in this record

go.opentelemetry.io/otel/sdk

Source reference: /affected/4/package/name

Affected versions
Not stated in this record
Fixed versions
1.45.0

Source reference: /affected/4/ranges

Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "SEMVER",
        "events": [
          {
            "introduced": "1.5.0"
          },
          {
            "fixed": "1.45.0"
          }
        ]
      }
    ],
    "package": {
      "name": "go.opentelemetry.io/otel/exporters/otlp/otlptrace",
      "purl": "pkg:golang/go.opentelemetry.io/otel/exporters/otlp/otlptrace",
      "ecosystem": "Go"
    },
    "database_specific": {
      "source": "https://vuln.go.dev/ID/GO-2026-6505.json"
    },
    "ecosystem_specific": {}
  },
  {
    "ranges": [
      {
        "type": "SEMVER",
        "events": [
          {
            "introduced": "1.5.0"
          },
          {
            "fixed": "1.45.0"
          }
        ]
      }
    ],
    "package": {
      "name": "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc",
      "purl": "pkg:golang/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc",
      "ecosystem": "Go"
    },
    "database_specific": {
      "source": "https://vuln.go.dev/ID/GO-2026-6505.json"
    },
    "ecosystem_specific": {}
  },
  {
    "ranges": [
      {
        "type": "SEMVER",
        "events": [
          {
            "introduced": "1.5.0"
          },
          {
            "fixed": "1.45.0"
          }
        ]
      }
    ],
    "package": {
      "name": "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp",
      "purl": "pkg:golang/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp",
      "ecosystem": "Go"
    },
    "database_specific": {
      "source": "https://vuln.go.dev/ID/GO-2026-6505.json"
    },
    "ecosystem_specific": {}
  },
  {
    "ranges": [
      {
        "type": "SEMVER",
        "events": [
          {
            "introduced": "1.5.0"
          },
          {
            "fixed": "1.45.0"
          }
        ]
      }
    ],
    "package": {
      "name": "go.opentelemetry.io/otel/exporters/zipkin",
      "purl": "pkg:golang/go.opentelemetry.io/otel/exporters/zipkin",
      "ecosystem": "Go"
    },
    "database_specific": {
      "source": "https://vuln.go.dev/ID/GO-2026-6505.json"
    },
    "ecosystem_specific": {}
  },
  {
    "ranges": [
      {
        "type": "SEMVER",
        "events": [
          {
            "introduced": "1.5.0"
          },
          {
            "fixed": "1.45.0"
          }
        ]
      }
    ],
    "package": {
      "name": "go.opentelemetry.io/otel/sdk",
      "purl": "pkg:golang/go.opentelemetry.io/otel/sdk",
      "ecosystem": "Go"
    },
    "database_specific": {
      "source": "https://vuln.go.dev/ID/GO-2026-6505.json"
    },
    "ecosystem_specific": {}
  }
]
Related CVEs
CVE-2026-81870

Source reference: /aliases

Publisher severity

No explicit severity was provided.

Linked CVE context

These ratings describe the referenced vulnerabilities and products. They are not a severity rating for every application using this dependency.

CVE-2026-81870 · Low

go.opentelemetry.io/otel/sdk, go.opentelemetry.io/otel/exporters/otlp/otlptrace, go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc, go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp, go.opentelemetry.io/otel/exporters/zipkin

Event
#63909 · Revision 2
Added to Heist Feed
Publisher date
Read the original announcement

Revision history

  1. GO-2026-6505 · Revision 2Risk context updated
  2. GHSA-8wmf-6v46-5gfg · Revision 1Source updated
  3. GO-2026-6505 · Revision 1Source updated