Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the sdk/trace.NewTracerProvider. An attacker can obtain sensitive information by accessing info-level diagnostic logs that may include internal collector endpoints and credentials embedded in URLs. Note: This ...

PT-2026-94018

Name of the Vulnerable Software and Affected Versions OpenTelemetry-Go versions 1.5.0 through 1.44.0 Description When sdk/trace.NewTracerProvider constructs a provider, it records a TracerProvider created internal Info-level diagnostic event. In affected versions, the MarshalLog implementations...