Opentelemetry Go
Monthly
Arbitrary code execution in OpenTelemetry Go SDK versions 1.20.0 through 1.39.0 on macOS results from insecure PATH resolution when executing the ioreg system command during resource detection. A local attacker with the ability to modify the PATH environment variable can hijack the command search path and execute arbitrary code with the privileges of the affected application. The vulnerability is resolved in version 1.40.0 and later.
Log telemetry exported over gRPC by OpenTelemetry-Go versions prior to 0.21.0 can be silently intercepted or modified because the otlploggrpc exporter reads TLS certificate settings from environment variables into its config but never applies them to the gRPC transport credentials. When TLS is configured only through OTEL_EXPORTER_OTLP_LOGS_CERTIFICATE, OTEL_EXPORTER_OTLP_CERTIFICATE, and the related client-certificate/key variables - and the application does not additionally call WithTLSCredentials in code - the client falls back to credentials.NewTLS with system roots and no client certificate, so the intended private-CA pinning and mutual TLS are bypassed. A network attacker in a man-in-the-middle position who can present a certificate chaining to the victim host's system trust store can read or alter exported log data; misconfigured code paths that do pass WithTLSCredentials are unaffected, the system-trusted-certificate prerequisite is a significant limiting factor, and no public exploit was identified at time of analysis. The issue is fixed in otlploggrpc v0.21.0.
CPU exhaustion in the OpenTelemetry-Go sdk/log BatchProcessor (BatchingProcessor built via NewBatchingProcessor) before version 0.21.0 lets attacker-driven, high-volume log emission pin a process's CPU when the wrapped log exporter is simultaneously slow or backpressured. The poll loop repeatedly retries a non-blocking queue dequeue and a failed non-blocking EnqueueExport without waiting on its ticker, because the failed enqueue leaves the queue length unchanged at or above batchSize, producing a tight busy-spin that degrades or denies service in the embedding application. This is an availability-only flaw (CWE-400) with no confidentiality or integrity impact, no public exploit code identified at time of analysis, and no confirmed active exploitation (not in CISA KEV); the assessed vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) is unauthenticated but requires the attacker to sustain log volume while the exporter is backpressured, which significantly narrows real-world exploitability.
Span attribute length limits can be bypassed in the OpenTelemetry-Go SDK trace package from 1.10.0 up to (but not including) 1.33.0, allowing an attacker who controls content recorded as a span attribute to retain string values far longer than the configured AttributeValueLengthLimit and thereby inflate per-span memory use inside the instrumented process. The root cause is a Unicode handling defect: the truncation helper misclassifies the valid replacement character U+FFFD as invalid UTF-8 and returns the original oversized value, and a fallback sanitization pass also leaves it unchanged. The impact is limited to a weakening of the SDK's built-in denial-of-service guard - there is no code execution, no confidentiality or integrity impact, and no public exploit code identified at time of analysis; the vendor scores it 5.1 (CVSS 4.0, AV:L, PR:N, VA:L) and our independent assessment is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L.
OpenTelemetry-Go versions 1.5.0 through 1.44.0 can write sensitive collector configuration into an application's own logs when the application explicitly opts into internal diagnostic logging through otel.SetLogger at Info verbosity: the TracerProvider created event serializes span processor, exporter, and client configuration, exposing OTLP gRPC and HTTP collector endpoints, the OTLP HTTP Insecure flag, and complete Zipkin collector URLs. Anyone able to read those logs - local files, aggregated log stores, or a SIEM - can reconstruct internal collector topology and can recover credentials or tokens where operators embedded them in Zipkin URL user-info or query strings. The vendor CVSS 4.0 base score is 2.0 and no public exploit identified at time of analysis; note that OTLP authentication headers, TLS key material, and span payloads are never written by this path, and default OpenTelemetry configurations that do not install a logger are unaffected because the default logger does not emit the diagnostic event.
Arbitrary code execution in OpenTelemetry Go SDK versions 1.20.0 through 1.39.0 on macOS results from insecure PATH resolution when executing the ioreg system command during resource detection. A local attacker with the ability to modify the PATH environment variable can hijack the command search path and execute arbitrary code with the privileges of the affected application. The vulnerability is resolved in version 1.40.0 and later.
Log telemetry exported over gRPC by OpenTelemetry-Go versions prior to 0.21.0 can be silently intercepted or modified because the otlploggrpc exporter reads TLS certificate settings from environment variables into its config but never applies them to the gRPC transport credentials. When TLS is configured only through OTEL_EXPORTER_OTLP_LOGS_CERTIFICATE, OTEL_EXPORTER_OTLP_CERTIFICATE, and the related client-certificate/key variables - and the application does not additionally call WithTLSCredentials in code - the client falls back to credentials.NewTLS with system roots and no client certificate, so the intended private-CA pinning and mutual TLS are bypassed. A network attacker in a man-in-the-middle position who can present a certificate chaining to the victim host's system trust store can read or alter exported log data; misconfigured code paths that do pass WithTLSCredentials are unaffected, the system-trusted-certificate prerequisite is a significant limiting factor, and no public exploit was identified at time of analysis. The issue is fixed in otlploggrpc v0.21.0.
CPU exhaustion in the OpenTelemetry-Go sdk/log BatchProcessor (BatchingProcessor built via NewBatchingProcessor) before version 0.21.0 lets attacker-driven, high-volume log emission pin a process's CPU when the wrapped log exporter is simultaneously slow or backpressured. The poll loop repeatedly retries a non-blocking queue dequeue and a failed non-blocking EnqueueExport without waiting on its ticker, because the failed enqueue leaves the queue length unchanged at or above batchSize, producing a tight busy-spin that degrades or denies service in the embedding application. This is an availability-only flaw (CWE-400) with no confidentiality or integrity impact, no public exploit code identified at time of analysis, and no confirmed active exploitation (not in CISA KEV); the assessed vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) is unauthenticated but requires the attacker to sustain log volume while the exporter is backpressured, which significantly narrows real-world exploitability.
Span attribute length limits can be bypassed in the OpenTelemetry-Go SDK trace package from 1.10.0 up to (but not including) 1.33.0, allowing an attacker who controls content recorded as a span attribute to retain string values far longer than the configured AttributeValueLengthLimit and thereby inflate per-span memory use inside the instrumented process. The root cause is a Unicode handling defect: the truncation helper misclassifies the valid replacement character U+FFFD as invalid UTF-8 and returns the original oversized value, and a fallback sanitization pass also leaves it unchanged. The impact is limited to a weakening of the SDK's built-in denial-of-service guard - there is no code execution, no confidentiality or integrity impact, and no public exploit code identified at time of analysis; the vendor scores it 5.1 (CVSS 4.0, AV:L, PR:N, VA:L) and our independent assessment is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L.
OpenTelemetry-Go versions 1.5.0 through 1.44.0 can write sensitive collector configuration into an application's own logs when the application explicitly opts into internal diagnostic logging through otel.SetLogger at Info verbosity: the TracerProvider created event serializes span processor, exporter, and client configuration, exposing OTLP gRPC and HTTP collector endpoints, the OTLP HTTP Insecure flag, and complete Zipkin collector URLs. Anyone able to read those logs - local files, aggregated log stores, or a SIEM - can reconstruct internal collector topology and can recover credentials or tokens where operators embedded them in Zipkin URL user-info or query strings. The vendor CVSS 4.0 base score is 2.0 and no public exploit identified at time of analysis; note that OTLP authentication headers, TLS key material, and span payloads are never written by this path, and default OpenTelemetry configurations that do not install a logger are unaffected because the default logger does not emit the diagnostic event.