CVE-2026-81870
CVE
Low
· CVSS 2
False Positivetelemetry/opentelemetry: Collector Endpoint Disclosure in Internal Diagnostic Logs
This advisory does not affect KrakenD
Emitting the event requires the application to call
otel.SetLogger with a
logger verbose enough to pass V(4). KrakenD never calls it: the
telemetry/opentelemetry integration only sets the propagator and an error handler,
and it reports its own diagnostics through the KrakenD logger. The global OpenTelemetry
logger therefore stays at its default, a logger that emits error messages only,
and the TracerProvider created event is dropped before anything reaches a log file.Addressed through routine dependency maintenance in EE 3.0.1, 2.13.11.
Component
OpenTelemetry-Go (trace exporters)
Disclosed
Sep 16, 2026
CVSS Score
2
Description
OpenTelemetry-Go 1.5.0 through 1.44.0 emits a
TracerProvider created internal
diagnostic event whose MarshalLog implementations recursively serialize the span
processors, their exporters, and the exporter client configuration. The event records
the OTLP/gRPC and OTLP/HTTP collector endpoints, the OTLP/HTTP Insecure flag, and the
complete Zipkin collector URL, so anyone with access to those logs learns the internal
collector topology and can recover credentials or tokens embedded in a Zipkin URL.
Authentication headers, TLS key material, and span payloads are never written. The
event is Info level, which the default OpenTelemetry logger discards, so an application
only exposes it by installing a verbose logger through otel.SetLogger.
OpenTelemetry-Go 1.45.0 records exporter types instead of their configuration.
This does not affect KrakenD, which never installs an OpenTelemetry internal logger.