THREAT OPS › Threat News › [GHSA] GHSA-8wmf-6v46-5gfg (low) — OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs
[GHSA] GHSA-8wmf-6v46-5gfg (low) — OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs
GHSA-8wmf-6v46-5gfg Severity: low CVE: CVE-2026-81870
OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs
### Summary
OpenTelemetry Go versions 1.5.0 through 1.44.0 can include trace exporter endpoint configuration in an internal diagnostic log emitted when an SDK `TracerProvider` is created. The default OpenTelemetry logger does not emit this event. Exposure requires
MITRE ATT&CK techniques
Indicators of compromise
- a1fff3c2588c783d1f3f6fd2315aa2660fc6d330sha1
- 3a1412d2b3bc4e4231fbeac2ed42117ae541bb38sha1
- CVE-2026-81870cve
- http://user:pass@zipkin.internal:9411/api/v2/spans?token=secreturl
- pass@zipkin.internalemail
- go.opentelemetry.iodomain
Original source: https://github.com/advisories/GHSA-8wmf-6v46-5gfg