The vulnerability stemmed from Jaeger logging the entire Kafka producer configuration struct, which included plaintext/Kerberos credentials. The commit 360c38b shows password fields were marked with json:"-" to prevent serialization, and tests were added to verify credentials don't appear in logs. The Red Hat bug analysis explicitly points to the logging in factory.go's Initialize method as the leak vector. The function's zap.Any() call serialized sensitive fields before the structs were properly annotated to exclude passwords.