Flexibility, performance and robustness are defining KrakenD just to name a few, we were able to quickly and easily build a robust gateway for our systems and we keep enjoying it everyday.
Samy Lastmann
CTO / Smart Tribune
CVE-2026-81870
CVE
Low
· CVSS 2
False Positiveotel.SetLogger with a
logger verbose enough to pass V(4). KrakenD never calls it: the
telemetry/opentelemetry integration only sets the propagator and an error handler,
and it reports its own diagnostics through the KrakenD logger. The global OpenTelemetry
logger therefore stays at its default, a logger that emits error messages only,
and the TracerProvider created event is dropped before anything reaches a log file.Component
OpenTelemetry-Go (trace exporters)
Disclosed
Sep 16, 2026
CVSS Score
2
TracerProvider created internal
diagnostic event whose MarshalLog implementations recursively serialize the span
processors, their exporters, and the exporter client configuration. The event records
the OTLP/gRPC and OTLP/HTTP collector endpoints, the OTLP/HTTP Insecure flag, and the
complete Zipkin collector URL, so anyone with access to those logs learns the internal
collector topology and can recover credentials or tokens embedded in a Zipkin URL.
Authentication headers, TLS key material, and span payloads are never written. The
event is Info level, which the default OpenTelemetry logger discards, so an application
only exposes it by installing a verbose logger through otel.SetLogger.
OpenTelemetry-Go 1.45.0 records exporter types instead of their configuration.
This does not affect KrakenD, which never installs an OpenTelemetry internal logger.Stay up to date with KrakenD releases and important updates