Vulnerability Description
OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.21.0, the exporters/otlp/otlplog/otlploggrpc package loads OTEL_EXPORTER_OTLP_LOGS_CERTIFICATE, OTEL_EXPORTER_OTLP_CERTIFICATE, and related client certificate environment variables through loadEnvTLS into cfg.tlsCfg, but newGRPCDialOptions does not apply cfg.tlsCfg when creating gRPC transport credentials. The environment-only TLS path instead uses credentials.NewTLS with system roots and no configured client certificate, bypassing intended private CA pinning and mutual TLS unless the application also supplies WithTLSCredentials. A network attacker able to intercept or spoof the collector connection with a system-trusted certificate can read or alter log telemetry. This issue is fixed in version 0.21.0.
Related Weaknesses (CWE)
References
- https://github.com/open-telemetry/opentelemetry-go/commit/c65d435b43e5e6b82310e6
- https://github.com/open-telemetry/opentelemetry-go/releases/tag/exporters/otlp/o
- https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-w34q
FAQ
What is CVE-2026-81871?
CVE-2026-81871 is a documented vulnerability. OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.21.0, the exporters/otlp/otlplog/otlploggrpc package loads OTEL_EXPORTER_OTLP_LOGS_CERTIFICATE, OTEL_EXPORTER_OTLP_CERTIF...
How severe is CVE-2026-81871?
CVSS scoring is not yet available for CVE-2026-81871. Check NVD for updates.
Is there a patch for CVE-2026-81871?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.