In open-telemetry opentelemetry-go versions >=1.5.0 and <1.45.0, the sdk/trace.NewTracerProvider function emits an internal Info-level diagnostic event whose MarshalLog implementations recursively include span processor, exporter, and client configuration details. When applications enable OpenTelemetry internal Info logging using otel.SetLogger, logs may contain OTLP gRPC and HTTP collector endpoints, the OTLP HTTP Insecure flag, and full Zipkin collector URLs. These logs can expose internal collector topology and credentials or tokens embedded in Zipkin URL user information or query strings. The default OpenTelemetry logger does not emit this event, and no OTLP authentication headers, TLS key material, or span payloads are logged. The vulnerability is addressed in version 1.45.0.

An attacker or unauthorized party with access to logs generated when OpenTelemetry internal Info logging is enabled can obtain sensitive configuration information including collector endpoints and embedded credentials or tokens in Zipkin URLs. This exposure could facilitate reconnaissance of internal telemetry infrastructure and potential credential compromise. However, authentication headers, TLS keys, and span payloads are not exposed. The CVSS 4.0 score is low (2.0), reflecting limited attack vector (local), low impact, and required privileges.

Upgrade opentelemetry-go to version 1.45.0 or later where this issue is fixed. If upgrading is not immediately possible, avoid enabling OpenTelemetry internal Info logging via otel.SetLogger to prevent emission of sensitive configuration details in logs. The default logger does not emit these events, so using default logging settings mitigates the risk.