OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.21.0, the exporters/otlp/otlplog/otlploggrpc package loads OTEL_EXPORTER_OTLP_LOGS_CERTIFICATE, OTEL_EXPORTER_OTLP_CERTIFICATE, and related client certificate environment variables through loadEnvTLS into cfg.tlsCfg, but newGRPCDialOptions does not apply cfg.tlsCfg when creating gRPC transport credentials. The environment-only TLS path instead uses credentials.NewTLS with system roots and no configured client certificate, bypassing intended private CA pinning and mutual TLS unless the application also supplies WithTLSCredentials. A network attacker able to intercept or spoof the collector connection with a system-trusted certificate can read or alter log telemetry. This issue is fixed in version 0.21.0.
CVE-2026-81869 is a medium severity vulnerability in the OpenTelemetry Go SDK trace package that allows bypass of the configured attribute value length limit for string attributes containing the Unicode replacement character U+FFFD. This flaw causes oversized attacker-controlled attribute values to be stored untruncated, weakening memory and denial-of-service protections. The vulnerability requires deployments with attribute value length limits enabled and attacker-controlled data recorded into span attributes. There is no indication of confidentiality or integrity impact.
OpenTelemetry-Go versions from 1.5.0 up to but not including 1.45.0 log detailed internal configuration information at the Info level when internal Info logging is enabled via otel.SetLogger. This can expose sensitive data such as OTLP collector endpoints, the OTLP HTTP Insecure flag, and full Zipkin collector URLs that may contain credentials or tokens. The default logger does not emit this event, and authentication headers, TLS keys, and span payloads are not logged. The issue is fixed in version 1.45.0.
CVE-2026-45404 is a race condition vulnerability in the OpenTelemetry-Go library affecting versions from 0.11.0 up to but not including 1.45.0. The issue arises from an unsynchronized map used in the OpenTracing bridge's bridgeSpan, which can cause concurrent read/write operations leading to a runtime panic. This can terminate the process and cause a denial of service. The vulnerability is fixed in version 1.45.0.
OpenTelemetry-Go is the Go implementation of OpenTelemetry. From 1.15.0 to 1.42.0, the fix for CVE-2026-24051 changed the Darwin ioreg command to use an absolute path but left the BSD kenv command using a bare name, allowing the same PATH hijacking attack on BSD and Solaris platforms. This vulnerability is fixed in 1.43.0.
CVE-2026-39882 is a medium severity vulnerability in the open-telemetry opentelemetry-go library versions prior to 1.43.0. The vulnerability arises because the OTLP HTTP exporters read the entire HTTP response body into memory without limiting its size, which can lead to memory exhaustion. This issue can be exploited if the collector endpoint is attacker-controlled or if a network attacker can intercept and manipulate the connection. The vulnerability has been fixed in version 1.43.0.
OpenTelemetry-Go is the Go implementation of OpenTelemetry. From 1.36.0 to 1.40.0, multi-value baggage: header extraction parses each header field-value independently and aggregates members across values. This allows an attacker to amplify cpu and allocations by sending many baggage: header lines, even when each individual value is within the 8192-byte per-value parse limit. This vulnerability is fixed in 1.41.0.
CVE-2026-24051 is a high-severity vulnerability affecting the OpenTelemetry-Go SDK versions 1.21.0 up to but not including 1.40.0 on macOS/Darwin systems. The vulnerability arises from an untrusted search path (CWE-426) in the resource detection code that executes the 'ioreg' system command without specifying an absolute path. An attacker with local access who can modify the PATH environment variable can hijack this command execution to run arbitrary code within the application's context. This flaw allows for arbitrary code execution without user interaction but requires local privileges and a high attack complexity. No known exploits are currently reported in the wild. The issue was fixed in version 1.