Skip to content

chore(deps): update security updates to v1.45.0 [security] - #542

Open
NumaryBot wants to merge 1 commit into
mainfrom
renovate/security
Open

chore(deps): update security updates to v1.45.0 [security]#542
NumaryBot wants to merge 1 commit into
mainfrom
renovate/security

Conversation

@NumaryBot

@NumaryBot NumaryBot commented Sep 18, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Type Update Change
go.opentelemetry.io/otel/exporters/otlp/otlptrace indirect minor v1.43.0 -> v1.45.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc indirect minor v1.41.0 -> v1.45.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc indirect minor v1.43.0 -> v1.45.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp indirect minor v1.43.0 -> v1.45.0
go.opentelemetry.io/otel/sdk indirect minor v1.44.0 -> v1.45.0

OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs

CVE-2026-81870 / GHSA-8wmf-6v46-5gfg

More information

Details

Summary

OpenTelemetry Go versions 1.5.0 through 1.44.0 can include trace exporter endpoint configuration in an internal diagnostic log emitted when an SDK TracerProvider is created. The default OpenTelemetry logger does not emit this event. Exposure requires an application to install a logger that enables OpenTelemetry's internal Info-level diagnostics and for someone other than the intended audience to have access to those logs.

The logged configuration can disclose the address of the trace collector and whether the OTLP/HTTP connection is configured as insecure. The Zipkin exporter logs its complete collector URL, so credentials in URL userinfo or tokens in the query string are also disclosed if an application embeds them there. OTLP authentication headers, TLS key material, and exported span data are not included in this log.

Exporter MarshalLog implementations that caused this configuration to be included in internal logs were introduced by a1fff3c.

Details

When sdk/trace.NewTracerProvider constructs a provider, it records a TracerProvider created internal Info event containing the provider configuration. In affected versions, the configuration's MarshalLog methods recursively include:

  1. the provider's span processors;
  2. each processor's span exporter; and
  3. for the OTLP trace exporter, its client configuration.

This causes the following values to be present in the event:

  • OTLP trace gRPC: the configured endpoint;
  • OTLP trace HTTP: the configured endpoint and the Insecure flag; and
  • Zipkin: the complete collector URL.

OpenTelemetry Go does not emit this event with its default logger, which only emits errors. An application must explicitly configure a sufficiently verbose logger with otel.SetLogger. The required logr verbosity is version-dependent:

  • versions 1.5.0 through 1.14.x use V(1) for this Info event; and
  • versions 1.15.0 through 1.44.0 use V(4).

OTLP header configuration is not part of the marshaled object, so credentials supplied with WithHeaders or the corresponding environment variables are not exposed. The documented OTLP WithEndpoint input is a collector address rather than a credential-bearing URL. The higher-risk case is therefore the Zipkin collector URL, which is retained and logged in full, or an application passing sensitive data in an OTLP endpoint outside the documented format.

Proof of concept

The following program demonstrates the behavior with OpenTelemetry Go 1.44.0. It deliberately places credentials and a token in the Zipkin collector URL and enables internal Info logging:

package main

import (
	"bytes"
	"context"
	"fmt"

	"github.com/go-logr/logr/funcr"
	"go.opentelemetry.io/otel"
	"go.opentelemetry.io/otel/exporters/zipkin"
	sdktrace "go.opentelemetry.io/otel/sdk/trace"
)

func main() {
	var logs bytes.Buffer
	otel.SetLogger(funcr.New(func(_, args string) {
		_, _ = logs.WriteString(args)
	}, funcr.Options{Verbosity: 4}))

	exporter, err := zipkin.New(
		"http://user:pass@zipkin.internal:9411/api/v2/spans?token=secret",
	)
	if err != nil {
		panic(err)
	}

	tp := sdktrace.NewTracerProvider(sdktrace.WithBatcher(exporter))
	_ = tp.Shutdown(context.Background())

	fmt.Println(logs.String())
}

The TracerProvider created event contains:

http://user:pass@zipkin.internal:9411/api/v2/spans?token=secret

For versions before 1.15.0, set funcr.Options{Verbosity: 1} instead.

Impact

This is a conditional disclosure through application logs. Affected applications must enable verbose OpenTelemetry internal diagnostics and configure a trace exporter containing information they do not intend to expose to readers of those logs. In that configuration, a person or system with log access can learn the trace collector address and internal network topology. If credentials or tokens are embedded directly in a Zipkin collector URL, those values can also be recovered from the logs.

There is no exposure with the default OpenTelemetry logger, and the vulnerable log is generated from local application configuration rather than remotely supplied span data. OTLP authentication headers, certificate or private-key contents, and telemetry payloads are not logged by this path.

Remediation

Upgrade the affected OpenTelemetry Go modules to version 1.45.0 or later. The fix in 3a1412d stops recursively marshaling exporter and client configuration and records their types instead.

If an immediate upgrade is not possible:

  • keep OpenTelemetry internal logging below the Info verbosity described above;
  • do not embed credentials or tokens in exporter endpoint URLs; use authentication headers or another supported credential mechanism; and
  • restrict access to existing logs and rotate any credentials that may already have been recorded.

Severity

  • CVSS Score: Unknown
  • Vector String: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Release Notes

open-telemetry/opentelemetry-go (go.opentelemetry.io/otel/exporters/otlp/otlptrace)

v1.45.0: /v0.67.0/v0.21.0/v0.0.18

Compare Source

Overview
Added
  • Add experimental observability metrics to BatchProcessor in go.opentelemetry.io/otel/sdk/log. (#​7124)
  • Add the experimental WithUnsafeAttributes no-copy attribute option to go.opentelemetry.io/otel/metric/x for future performance improvements. This API is a work in progress. (#​8251)
  • Add Map and MapValue functions for the new MAP attribute type in go.opentelemetry.io/otel/attribute. (#​8445)
  • Support MAP attributes in go.opentelemetry.io/otel/exporters/otlp/otlptrace. (#​8453)
  • Support MAP attributes in go.opentelemetry.io/otel/exporters/otlp/otlplog. (#​8453)
  • Support MAP attributes in go.opentelemetry.io/otel/exporters/otlp/otlpmetric. (#​8453)
  • Support MAP attributes in go.opentelemetry.io/otel/exporters/zipkin. (#​8453)
  • Apply AttributeValueLengthLimit recursively to values contained in attribute.MAP attributes in go.opentelemetry.io/otel/sdk/trace. (#​8454)
  • Remove duplicate keys from attribute.MAP values in go.opentelemetry.io/otel/sdk/resource using last-value-wins semantics. (#​8471)
  • Remove duplicate keys by default from attribute.MAP values in instrumentation scope attributes in go.opentelemetry.io/otel/sdk/log using last-value-wins semantics. (#​8471)
  • Remove duplicate keys by default from attribute.MAP values in span, event, link, and instrumentation scope attributes in go.opentelemetry.io/otel/sdk/trace using last-value-wins semantics. (#​8471)
  • Remove duplicate keys by default from attribute.MAP values in measurement and instrumentation scope attributes in go.opentelemetry.io/otel/sdk/metric using last-value-wins semantics. (#​8471)
  • Extend WithAllowKeyDuplication in go.opentelemetry.io/otel/sdk/log to disable duplicate-key removal in attribute.MAP values for instrumentation scope attributes. (#​8471)
  • Add the go.opentelemetry.io/otel/semconv/v1.42.0 package.
    The package contains semantic conventions from the v1.42.0 version of the OpenTelemetry Semantic Conventions.
    See the migration documentation for information on how to upgrade from go.opentelemetry.io/otel/semconv/v1.41.0. (#​8484)
  • Add WithoutPanicRecording as a TracerProviderOption in go.opentelemetry.io/otel/sdk/trace to disable exception event recording for panics. (#​8532)
  • Add the go.opentelemetry.io/otel/semconv/v1.43.0 package.
    The package contains semantic conventions from the v1.43.0 version of the OpenTelemetry Semantic Conventions.
    See the migration documentation for information on how to upgrade from go.opentelemetry.io/otel/semconv/v1.42.0. (#​8628)
Changed
  • HistogramReservoir in go.opentelemetry.io/otel/sdk/metric/exemplar now uses a time-unbiased sampling algorithm for exemplars. (#​8306)
  • ⚠️ Breaking Change: Use go.opentelemetry.io/otel/attribute.Value and go.opentelemetry.io/otel/attribute.KeyValue for log bodies and attributes in go.opentelemetry.io/otel/log, go.opentelemetry.io/otel/log/logtest, go.opentelemetry.io/otel/sdk/log, and go.opentelemetry.io/otel/sdk/log/logtest. (#​8490)
  • Encode log bodies and attributes as go.opentelemetry.io/otel/attribute.Value JSON in go.opentelemetry.io/otel/exporters/stdout/stdoutlog. (#​8490)
  • Improve the performance of hashing BOOLSLICE, INT64SLICE, FLOAT64SLICE, and STRINGSLICE attribute values by avoiding reflection for short slices in go.opentelemetry.io/otel/attribute. (#​8511)
  • ⚠️ Breaking Change: WithEndpointURL in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp no longer appends the default signal path when an endpoint URL has no path, making the behavior consistent with go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp and with setting the endpoint through OTEL_EXPORTER_OTLP_METRICS_ENDPOINT. If the URL has no path component, the root path (/) is used. Use WithEndpointURL(url.JoinPath(endpoint, "/v1/metrics")) to preserve the previous behavior. (#​8538)
  • ⚠️ Breaking Change: WithEndpointURL in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp no longer appends the default signal path when an endpoint URL has no path, making the behavior consistent with go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp and with setting the endpoint through OTEL_EXPORTER_OTLP_TRACES_ENDPOINT. If the URL has no path component, the root path (/) is used. Use WithEndpointURL(url.JoinPath(endpoint, "/v1/traces")) to preserve the previous behavior. (#​8538)
Deprecated
  • Deprecate WithExportBufferSize in go.opentelemetry.io/otel/sdk/log. The option remains available for source compatibility but no longer affects behavior; BatchProcessor no longer maintains a separate export-request buffer. (#​8620)
Removed
  • ⚠️ Breaking Change: Remove Kind, Value, KeyValue, their constructors, and attribute conversion helpers from go.opentelemetry.io/otel/log. (#​8490)
  • ⚠️ Breaking Change: Remove the AttributeValueLengthLimit and AttributeCountLimit fields from RecordFactory in go.opentelemetry.io/otel/sdk/log/logtest; records produced by the factory now keep attribute limits disabled so test code can append exact attributes. (#​8556)
Fixed
  • Apply TLS certificates configured through environment variables to gRPC connections in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc.
  • Prevent panics in go.opentelemetry.io/otel/bridge/opentracing when OpenTracing baggage is propagated concurrently with Span.SetBaggageItem.
  • Fix an off-by-one error in FixedSizeReservoir in go.opentelemetry.io/otel/sdk/metric/exemplar that prevented the first exemplar from being sampled after the reservoir was filled. (#​8309)
  • Interpret HTTP Retry-After header values as seconds instead of nanoseconds when retrying OTLP HTTP exports in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp, go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp, and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#​8383)
  • Fix a memory leak in the Reservoir implementation in go.opentelemetry.io/otel/sdk/metric/exemplar, where storing the full context.Context pinned large objects such as gRPC transport buffers. (#​8389)
  • Prevent a non-empty attribute set whose computed hash is zero from collapsing to an empty set in go.opentelemetry.io/otel/attribute. (#​8402)
  • Fix histogram data point reuse in go.opentelemetry.io/otel/sdk/metric aggregation to avoid leaking stale sum, minimum, and maximum values when they are disabled in subsequent collections. (#​8403)
  • Avoid preallocating scope attributes when they are disabled in go.opentelemetry.io/otel/exporters/prometheus. (#​8404)
  • Support HTTP-date values in the HTTP Retry-After header when retrying OTLP HTTP exports in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp, go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp, and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#​8417)
  • Reduce histogram heap allocations by reusing BucketCounts and Exemplars slices across Collect cycles in the cumulative histogram aggregation in go.opentelemetry.io/otel/sdk/metric. (#​8428)
  • Fix go.opentelemetry.io/otel/exporters/stdout/stdouttrace self-observability to record error.type on the operation-duration histogram when the exportedSpans metric is disabled. (#​8432)
  • Stop including trace exporter endpoint configuration in internal logs from go.opentelemetry.io/otel/sdk/trace, go.opentelemetry.io/otel/exporters/otlp/otlptrace, go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc, go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp, and go.opentelemetry.io/otel/exporters/zipkin. (#​8438)
  • Fix invalid error formatting for out-of-range JSON code values in go.opentelemetry.io/otel/codes. (#​8497)
  • Clarify in go.opentelemetry.io/otel/log that Logger.Enabled should be checked for every log emission because its result may change over time. (#​8565)
  • Preserve user-provided exception attributes while independently deriving missing exception message and type attributes in go.opentelemetry.io/otel/sdk/log. (#​8566)
  • Make WithAttributeCountLimit(0) and OTEL_LOGRECORD_ATTRIBUTE_COUNT_LIMIT=0 discard all log record attributes in go.opentelemetry.io/otel/sdk/log. (#​8570)
  • Clarify that the Record methods of Float64Histogram and Int64Histogram in go.opentelemetry.io/otel/metric expect non-negative values. (#​8574)
  • Clarify in go.opentelemetry.io/otel/log that LoggerProvider implementations should retain an empty Logger name instead of replacing it with a default. (#​8587)
  • Ensure that the built-in processors in go.opentelemetry.io/otel/sdk/log call exporter ForceFlush during Shutdown. (#​8599)
  • Prevent panics in go.opentelemetry.io/otel/bridge/opentracing when OpenTracing baggage is propagated concurrently with Span.SetBaggageItem. (GHSA-42cj-99w8-cp2p)
  • Prevent processor operations in go.opentelemetry.io/otel/sdk/log from overlapping with processor shutdown or running after LoggerProvider shutdown. (#​8608)
  • Prevent BatchProcessor in go.opentelemetry.io/otel/sdk/log from busy-spinning under exporter backpressure and serialize dequeue, export, force-flush, and shutdown work in one worker. (#​8620)
  • Make BatchProcessor in go.opentelemetry.io/otel/sdk/log return errors encountered while draining records during ForceFlush and Shutdown, while continuing to attempt later batches as long as the request context remains valid. (#​8620)
  • Keep the default BatchProcessor maximum export batch size in go.opentelemetry.io/otel/sdk/log at or below the configured maximum queue size. (#​8620)
What's Changed

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

@NumaryBot
NumaryBot requested a review from a team as a code owner September 18, 2026 02:09
@NumaryBot
NumaryBot enabled auto-merge (squash) September 18, 2026 02:09
@NumaryBot

NumaryBot commented Sep 18, 2026

Copy link
Copy Markdown
Contributor Author

ℹ Artifact update notice

File name: deployment/operator/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 7 additional dependencies were updated

Details:

Package Change
github.com/go-logr/logr v1.4.3 -> v1.4.4
go.opentelemetry.io/otel v1.44.0 -> v1.45.0
go.opentelemetry.io/otel/metric v1.44.0 -> v1.45.0
go.opentelemetry.io/otel/trace v1.44.0 -> v1.45.0
go.opentelemetry.io/proto/otlp v1.10.0 -> v1.11.0
google.golang.org/genproto/googleapis/api v0.0.0-20260526163538-3dc84a4a5aaa -> v0.0.0-20260803160001-6ac0973c030d
google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa -> v0.0.0-20260803160001-6ac0973c030d
File name: tools/utils/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 8 additional dependencies were updated

Details:

Package Change
github.com/go-logr/logr v1.4.3 -> v1.4.4
github.com/grpc-ecosystem/grpc-gateway/v2 v2.28.0 -> v2.29.0
go.opentelemetry.io/otel v1.44.0 -> v1.45.0
go.opentelemetry.io/otel/metric v1.44.0 -> v1.45.0
go.opentelemetry.io/otel/trace v1.44.0 -> v1.45.0
go.opentelemetry.io/proto/otlp v1.10.0 -> v1.11.0
google.golang.org/genproto/googleapis/api v0.0.0-20260526163538-3dc84a4a5aaa -> v0.0.0-20260803160001-6ac0973c030d
google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa -> v0.0.0-20260803160001-6ac0973c030d

NumaryBot
NumaryBot commented Sep 18, 2026
View reviewed changes

@NumaryBot NumaryBot left a comment

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Findings

Comment thread tools/utils/go.mod
github.com/go-sql-driver/mysql v1.9.3 // indirect
github.com/google/uuid v1.6.0 // indirect
github.com/grpc-ecosystem/grpc-gateway/v2 v2.28.0 // indirect
github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0 // indirect

@NumaryBot NumaryBot Sep 18, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔵 [suggestion] Unlisted transitive bumps beyond the PR's stated package table

The PR description only lists otlptrace, otlptracegrpc, otlptracehttp and sdk -> v1.45.0, but the diff also bumps go.opentelemetry.io/otel, metric, trace, proto/otlp, logr, genproto and grpc-gateway/v2. These follow from Go MVS resolution of the otel 1.45.0 minor bump and match go.sum at head, so they are expected; no change needed.

NumaryBot
NumaryBot commented Sep 19, 2026
View reviewed changes

@NumaryBot NumaryBot left a comment

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Findings

Comment thread tools/utils/go.mod
github.com/cespare/xxhash/v2 v2.3.0 // indirect
github.com/felixge/httpsnoop v1.0.4 // indirect
github.com/go-logr/logr v1.4.3 // indirect
github.com/go-logr/logr v1.4.4 // indirect

@NumaryBot NumaryBot Sep 19, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 [minor] PR description omits several transitive bumps included in the diff

The spec table lists only OpenTelemetry module updates, but the diff also bumps github.com/go-logr/logr 1.4.3->1.4.4, github.com/grpc-ecosystem/grpc-gateway/v2 2.28.0->2.29.0, google.golang.org/genproto/... snapshots, and go.opentelemetry.io/proto/otlp 1.10.0->1.11.0. These are typical Renovate transitive maintenance with no visible behavioral risk. No correction needed; flagging so human reviewers know the PR is slightly wider than described.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@flemzord flemzord flemzord approved these changes

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

bot-reviewed human-review-required risk: high security

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@NumaryBot @flemzord