{"data":{"id":"c03f0a4f-27f2-47ec-a84d-37de61dbd8fa","title":"GHSA-8wmf-6v46-5gfg: OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs","summary":"OpenTelemetry-Go versions 1.5.0 through 1.44.0 can accidentally leak trace exporter endpoint URLs and configuration details in internal diagnostic logs when an application enables verbose logging. The vulnerability only affects apps that explicitly configure a verbose logger and use exporters like Zipkin with credentials embedded in URLs, potentially exposing collector addresses, network topology, and embedded credentials to anyone with access to those logs.","solution":"Update to OpenTelemetry-Go version 1.45.0 or later. The source text indicates the vulnerability affects versions 1.5.0 through 1.44.0, implying a fix is available in subsequent releases.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-8wmf-6v46-5gfg","publishedAt":"2026-09-17T20:31:06.000Z","cveId":"CVE-2026-81870","cweIds":null,"cvssScore":null,"cvssSeverity":"low","severity":"low","attackType":["pii_leakage"],"issueType":"vulnerability","affectedPackages":["go.opentelemetry.io/otel/exporters/zipkin@>= 1.5.0, <= 1.44.0 (fixed: 1.45.0)","go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@>= 1.5.0, <= 1.44.0 (fixed: 1.45.0)","go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc@>= 1.5.0, <= 1.44.0 (fixed: 1.45.0)","go.opentelemetry.io/otel/exporters/otlp/otlptrace@>= 1.5.0, <= 1.44.0 (fixed: 1.45.0)","go.opentelemetry.io/otel/sdk@>= 1.5.0, <= 1.44.0 (fixed: 1.45.0)"],"affectedVendors":[],"affectedVendorsRaw":["OpenTelemetry"],"classifierModel":"claude-haiku-4-5-20251001","classifierPromptVersion":"v3","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0,"patchAvailable":true,"disclosureDate":"2026-09-17T20:31:06.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality"],"aiComponentTargeted":null,"llmSpecific":false,"classifierConfidence":0.65,"researchCategory":null,"atlasIds":null}}