Search: CVE-2026-81870

OpenTelemetry-Go versions from 1.5.0 up to but not including 1.45.0 log detailed internal configuration information at the Info level when internal Info logging is enabled via otel.SetLogger. This can expose sensitive data such as OTLP collector endpoints, the OTLP HTTP Insecure flag, and full Zipkin collector URLs that may contain credentials or tokens. The default logger does not emit this event, and authentication headers, TLS keys, and span payloads are not logged. The issue is fixed in version 1.45.0.