Advisories for Golang/Go.opentelemetry.io/Otel/Exporters/Zipkin package

2026

OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs

OpenTelemetry Go versions 1.5.0 through 1.44.0 can include trace exporter endpoint configuration in an internal diagnostic log emitted when an SDK TracerProvider is created. The default OpenTelemetry logger does not emit this event. Exposure requires an application to install a logger that enables OpenTelemetry's internal Info-level diagnostics and for someone other than the intended audience to have access to those logs. The logged configuration can disclose the address of the …