{"id":"CVE-2026-81871","aliases":["GHSA-w34q-cm8f-9c5x"],"url":"https://o3.security/vulnerability/CVE-2026-81871","summary":"OpenTelemetry-Go: Log gRPC exporter ignores env TLS certs, bypassing mTLS/pinning","details":"OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.21.0, the exporters/otlp/otlplog/otlploggrpc package loads OTEL_EXPORTER_OTLP_LOGS_CERTIFICATE, OTEL_EXPORTER_OTLP_CERTIFICATE, and related client certificate environment variables through loadEnvTLS into cfg.tlsCfg, but newGRPCDialOptions does not apply cfg.tlsCfg when creating gRPC transport credentials. The environment-only TLS path instead uses credentials.NewTLS with system roots and no configured client certificate, bypassing intended private CA pinning and mutual TLS unless the application also supplies WithTLSCredentials. A network attacker able to intercept or spoof the collector connection with a system-trusted certificate can read or alter log telemetry. This issue is fixed in version 0.21.0.","published":"2026-09-16T20:43:40.119Z","modified":"2026-09-18T03:48:30.500214394Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"Go","name":"go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc","fixedVersion":"0.21.0"}],"fix":{"url":"https://github.com/open-telemetry/opentelemetry-go/commit/c65d435b43e5e6b82310e6b18dd4cdcb8ac63a0c","label":"open-telemetry/opentelemetry-go@c65d435"},"references":[{"type":"WEB","url":"https://github.com/open-telemetry/opentelemetry-go/releases/tag/exporters/otlp/otlplog/otlploggrpc/v0.21.0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81871.json"},{"type":"ADVISORY","url":"https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-w34q-cm8f-9c5x"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81871"},{"type":"FIX","url":"https://github.com/open-telemetry/opentelemetry-go/commit/c65d435b43e5e6b82310e6b18dd4cdcb8ac63a0c"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-09-18T03:48:30.500214394Z"}}