CVE-2026-81870: 
Terraform Community vulnerability analysis and mitigation

CVE-2026-81870 is an information disclosure vulnerability in OpenTelemetry-Go (the Go implementation of OpenTelemetry) where sdk/trace.NewTracerProvider emits an internal Info-level diagnostic event whose MarshalLog implementations recursively include span processor, exporter, and client configuration. This can expose OTLP gRPC and HTTP collector endpoints, the OTLP HTTP Insecure flag, and complete Zipkin collector URLs — including credentials or tokens embedded in URL userinfo or query strings — to anyone with access to application logs. Affected versions are 1.5.0 through 1.44.0 across modules go.opentelemetry.io/otel/sdk, go.opentelemetry.io/otel/exporters/otlp/otlptrace, go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc, go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp, and go.opentelemetry.io/otel/exporters/zipkin. The vulnerability was published on September 16, 2026, and carries a CVSS v4.0 base score of 2.0 (Low) (GitHub Advisory).

The root cause is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) and CWE-532 (Insertion of Sensitive Information into Log File). When sdk/trace.NewTracerProvider constructs a provider, it records a TracerProvider created internal Info event; in affected versions, the MarshalLog methods on span processors recursively serialize the attached exporter and its client configuration, causing endpoint URLs, the OTLP/HTTP Insecure flag, and full Zipkin collector URLs (including embedded credentials and query tokens) to appear in log output. Exploitation requires a local attacker with read access to application logs, and the application must have explicitly called otel.SetLogger with a sufficiently verbose logger (verbosity level V(1) for versions 1.5.0–1.14.x, or V(4) for versions 1.15.0–1.44.0) — the default OpenTelemetry logger does not emit this event. Notably, OTLP authentication headers, TLS key material, and exported span payloads are not exposed by this path (GitHub Advisory, Fix PR #8438).

Successful exploitation allows an attacker with log read access to recover internal collector topology (OTLP gRPC/HTTP endpoint addresses), the OTLP/HTTP insecure transport flag, and — in the highest-risk scenario — credentials or tokens embedded directly in Zipkin collector URLs. This information can enable follow-on attacks such as lateral movement to the trace collector, credential reuse against internal services, or network reconnaissance. There is no direct impact on integrity or availability, and the vulnerability does not expose OTLP authentication headers, TLS private keys, or telemetry payloads (GitHub Advisory).

A proof-of-concept Go program is publicly available in the GitHub Security Advisory, demonstrating the leak by configuring a Zipkin exporter with a credential-bearing URL (http://user:pass@zipkin.internal:9411/api/v2/spans?token=secret) and enabling verbose internal logging to capture the exposed endpoint in logs (GitHub Advisory). There is no evidence of in-the-wild exploitation at this time, and the EPSS score is 0.0. The vulnerability is not listed in the CISA KEV catalog. Exploitation is not automatable and requires specific preconditions: the application must enable verbose Info-level OpenTelemetry logging and the attacker must have local log read access (Feedly).

1. Identify target applications: Locate Go applications using OpenTelemetry-Go SDK versions 1.5.0–1.44.0 that have explicitly called otel.SetLogger() with a verbose logger (Verbosity: 1 for v1.5.0–1.14.x, or Verbosity: 4 for v1.15.0–1.44.0) and configure a Zipkin, OTLP gRPC, or OTLP HTTP trace exporter.
2. Gain log access: Obtain read access to the application's logs via local file system access, a compromised log aggregation system (e.g., Elasticsearch, Splunk), log backup theft, or shared log storage.
3. Locate the TracerProvider creation event: Search logs for the TracerProvider created internal diagnostic event, which is emitted once at application startup when sdktrace.NewTracerProvider() is called.
4. Extract sensitive configuration: Parse the log entry to recover Zipkin collector URLs with embedded credentials (e.g., http://user:pass@zipkin.internal:9411/api/v2/spans?token=secret), OTLP gRPC/HTTP endpoint addresses, and the OTLP/HTTP Insecure flag value.
5. Use recovered data for follow-on attacks: Leverage extracted credentials for authentication against the trace collector or related internal services; use endpoint addresses and topology information for network reconnaissance or lateral movement (GitHub Advisory).

• Logs: Presence of a TracerProvider created internal diagnostic log entry containing full Zipkin collector URLs (e.g., http://user:pass@zipkin.internal:9411/api/v2/spans?token=secret), OTLP endpoint hostnames/ports, or an Insecure: true field in application logs from OpenTelemetry-Go versions 1.5.0–1.44.0.
• Logs: Log entries showing otel.SetLogger configured with funcr.Options{Verbosity: 4} (or Verbosity: 1 for older versions), indicating verbose internal OpenTelemetry diagnostics are enabled.
• File System / Configuration: Application configuration or source code referencing Zipkin exporter URLs with embedded userinfo credentials or query string tokens (e.g., http://user:pass@host/path?token=value), which would be at risk of exposure if verbose logging is enabled (GitHub Advisory).

Upgrade all affected OpenTelemetry-Go modules to version 1.45.0 or later, which fixes the issue by replacing recursive MarshalLog serialization of exporter/client internals with type-string-only output (commit 3a1412d) (Fix PR #8438, SDK v1.45.0 Release). If an immediate upgrade is not possible, apply the following interim mitigations: (1) keep OpenTelemetry internal logging below the Info verbosity threshold (do not call otel.SetLogger with V(1) or V(4) in production); (2) do not embed credentials or tokens directly in Zipkin collector URLs — use authentication headers or another supported credential mechanism instead; (3) restrict access to existing logs and rotate any credentials that may already have been recorded (GitHub Advisory).