CVE-2026-81870: OpenTelemetry-Go Information Disclosure

CVE-2026-81870 Overview

CVE-2026-81870 is an information disclosure vulnerability in OpenTelemetry-Go, the Go implementation of the OpenTelemetry observability framework. Versions 1.5.0 through 1.44.0 emit an internal Info-level diagnostic event when sdk/trace.NewTracerProvider is created. The event's MarshalLog implementations recursively include span processor, exporter, and client configuration. Applications that call otel.SetLogger to enable OpenTelemetry internal Info logging record OTLP gRPC and HTTP collector endpoints, the OTLP HTTP Insecure flag, and complete Zipkin collector URLs. Anyone with access to those logs can learn internal collector topology and recover credentials or tokens embedded in Zipkin URL user information or query strings. The issue is fixed in version 1.45.0.

Critical Impact
Log readers can obtain internal collector endpoints and any credentials embedded in Zipkin URLs, exposing observability infrastructure and enabling downstream authentication attacks.

Affected Products

OpenTelemetry-Go SDK (go.opentelemetry.io/otel/sdk) versions 1.5.0 through 1.44.0
OpenTelemetry-Go OTLP trace exporter (go.opentelemetry.io/otel/exporters/otlp/otlptrace) prior to 1.45.0
OpenTelemetry-Go Zipkin exporter (go.opentelemetry.io/otel/exporters/zipkin) prior to 1.45.0

Discovery Timeline

2026-09-16 - CVE CVE-2026-81870 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-81870

Vulnerability Analysis

The vulnerability is a sensitive information exposure [CWE-200] in the OpenTelemetry-Go SDK diagnostic logging path. When an application constructs a TracerProvider, the SDK emits an internal Info-level log event describing the newly created provider. The MarshalLog methods on the exporter and its client recursively serialize their fields, including the full client configuration.

For the OTLP trace exporter, this exposed the collector endpoint hostname and port along with the Insecure flag indicating whether TLS is enforced. For the Zipkin exporter, the marshalled output includes the full collector URL. Zipkin URLs commonly embed authentication material in the userinfo component (https://user:token@collector/...) or as query string parameters. Log sinks or downstream log aggregation systems therefore receive credentials in plain text.

The default logr sink used by OpenTelemetry does not emit Info-level events, so the exposure only occurs when operators explicitly enable Info logging via otel.SetLogger. Authentication headers, TLS key material, and span payloads are not affected.

Root Cause

The MarshalLog implementations on exporter structs embed the full Client interface value instead of a type-only descriptor. The recursive marshalling then traverses client configuration fields, including the endpoint URL and transport settings, and writes them into diagnostic logs.

Attack Vector

Exploitation requires access to application logs that were written with OpenTelemetry Info logging enabled. This is a local, low-privilege data exposure: any operator, log-analytics user, or attacker with read access to log storage can extract the endpoints and any embedded Zipkin credentials, then reuse them to authenticate to the collector or map internal topology.

 func (e *Exporter) MarshalLog() any {
 	return struct {
 		Type   string
-		Client Client
+		Client string
 	}{
 		Type:   "otlptrace",
-		Client: e.client,
+		Client: fmt.Sprintf("%T", e.client),
 	}
 }

Source: GitHub Commit 3a1412d. The patch replaces the embedded Client interface with its Go type name, preventing recursive serialization of endpoint configuration.

Detection Methods for CVE-2026-81870

Indicators of Compromise

Log entries containing the string TracerProvider created alongside serialized Client fields that include an Endpoint value.
Zipkin exporter log entries containing full collector URLs with userinfo (for example, https://user:token@) or authentication query parameters.
OTLP exporter log entries revealing Insecure: true, indicating unencrypted collector traffic.

Detection Strategies

Audit application source and configuration for calls to otel.SetLogger that raise the log verbosity to Info or higher on affected SDK versions.
Grep centralized logs and log-archive storage for OpenTelemetry diagnostic events emitted between the introduction of 1.5.0 and the deployment of 1.45.0.
Inventory Go modules using go list -m all and flag any dependency on go.opentelemetry.io/otel/sdk earlier than v1.45.0.

Monitoring Recommendations

Alert when new log records contain OTLP or Zipkin endpoint patterns paired with credential-like tokens.
Rotate any Zipkin collector credentials that were valid during the period logs were captured, and monitor those credentials for reuse.
Restrict read access to observability logs and treat historical log archives as sensitive until scrubbed.

How to Mitigate CVE-2026-81870

Immediate Actions Required

Upgrade go.opentelemetry.io/otel/sdk, go.opentelemetry.io/otel/exporters/otlp/otlptrace, and go.opentelemetry.io/otel/exporters/zipkin to v1.45.0 or later and rebuild affected services.
Rotate any credentials or tokens that were embedded in Zipkin collector URLs while vulnerable versions were deployed.
Purge or redact historical log records that contain exporter endpoint configuration from log aggregation systems and cold storage.

Patch Information

The fix is delivered in OpenTelemetry-Go v1.45.0. See the SDK v1.45.0 release notes, the Zipkin exporter v1.45.0 release, and Pull Request #8438. The GHSA-8wmf-6v46-5gfg advisory contains the full disclosure.

Workarounds

Do not call otel.SetLogger with a sink that records Info-level events until the SDK is upgraded.
Configure Zipkin collector authentication through headers or out-of-band mechanisms rather than embedding secrets in the collector URL.
Apply log-pipeline redaction rules that strip Endpoint, Client, and URL fields from OpenTelemetry diagnostic events.

bash

# Upgrade the affected modules in a Go project
go get go.opentelemetry.io/otel/sdk@v1.45.0
go get go.opentelemetry.io/otel/exporters/otlp/otlptrace@v1.45.0
go get go.opentelemetry.io/otel/exporters/zipkin@v1.45.0
go mod tidy