--- id: CVE-2026-81871 title: OpenTelemetry-Go is the Go implementation of OpenTelemetry summary: >- OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.21.0, the exporters/otlp/otlplog/otlploggrpc package loads OTEL_EXPORTER_OTLP_LOGS_CERTIFICATE, OTEL_EXPORTER_OTLP_CERTIFICATE, and related client certificate… severity: medium cvss: 6.3 cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N' cwe: - CWE-295 - CWE-923 vendor: open-telemetry product: opentelemetry-go affected: - opentelemetry-go < 0.21.0 published: '2026-09-16' updated: '2026-09-17' sourceUpdated: '2026-09-17T20:18:40.623' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-81871' references: - url: >- https://github.com/open-telemetry/opentelemetry-go/commit/c65d435b43e5e6b82310e6b18dd4cdcb8ac63a0c label: security-advisories@github.com - url: >- https://github.com/open-telemetry/opentelemetry-go/releases/tag/exporters/otlp/otlplog/otlploggrpc/v0.21.0 label: security-advisories@github.com - url: >- https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-w34q-cm8f-9c5x label: security-advisories@github.com - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-81871' - url: 'https://github.com/open-telemetry/opentelemetry-go' - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-81871.json - url: 'https://access.redhat.com/security/cve/CVE-2026-81871' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2535725' - url: 'https://www.cve.org/CVERecord?id=CVE-2026-81871' - url: 'https://access.redhat.com/errata/RHSA-2026:68715' - url: 'https://access.redhat.com/errata/RHSA-2026:68716' - url: 'https://access.redhat.com/errata/RHSA-2026:68777' - url: 'https://access.redhat.com/errata/RHSA-2026:68821' - url: 'https://access.redhat.com/errata/RHSA-2026:68926' - url: 'https://access.redhat.com/errata/RHSA-2026:68778' - url: 'https://access.redhat.com/errata/RHSA-2026:68717' - url: 'https://access.redhat.com/errata/RHSA-2026:68729' - url: 'https://access.redhat.com/errata/RHSA-2026:68910' - url: 'https://access.redhat.com/errata/RHSA-2026:68932' - url: 'https://access.redhat.com/errata/RHSA-2026:68941' - url: 'https://access.redhat.com/errata/RHSA-2026:68905' - url: 'https://access.redhat.com/errata/RHSA-2026:68903' - url: 'https://access.redhat.com/errata/RHSA-2026:68912' tags: - nvd - cve.org - osv - go - csaf - vex - red-hat ssvc: exploitation: none automatable: 'no' technicalImpact: partial timestamp: '2026-09-17T17:10:34.419383Z' cvssSource: cna ingestedAt: '2026-09-16T21:05:36.879Z' aliases: - GHSA-w34q-cm8f-9c5x ecosystem: go patched: - go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc 0.21.0 scores: cna: 6.3 vendor: 6.5 epss: 0.00328 epssPercentile: 0.23222 --- ## Overview OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.21.0, the exporters/otlp/otlplog/otlploggrpc package loads OTEL_EXPORTER_OTLP_LOGS_CERTIFICATE, OTEL_EXPORTER_OTLP_CERTIFICATE, and related client certificate environment variables through loadEnvTLS into cfg.tlsCfg, but newGRPCDialOptions does not apply cfg.tlsCfg when creating gRPC transport credentials. The environment-only TLS path instead uses credentials.NewTLS with system roots and no configured client certificate, bypassing intended private CA pinning and mutual TLS unless the application also supplies WithTLSCredentials. A network attacker able to intercept or spoof the collector connection with a system-trusted certificate can read or alter log telemetry. This issue is fixed in version 0.21.0. ## Remediation Refer to the linked advisories for vendor-supplied fixes and affected version ranges. ## Package advisory (CVE-2026-81871) Affected packages: - `go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc < 0.21.0` Patched in: - `go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc 0.21.0` Source: https://osv.dev/vulnerability/GHSA-w34q-cm8f-9c5x ## Vendor advisories - **Red Hat VEX** · Moderate · affected: Assisted Installer for Red Hat OpenShift Container Platform 2, Logging Subsystem for Red Hat OpenShift, Multiarch Tuning Operator, Multicluster Engine for Kubernetes, Multicluster Global Hub, OpenShift Developer Tools and Services, … · no fix planned: Assisted Installer for Red Hat OpenShift Container Platform 2, Logging Subsystem for Red Hat OpenShift, OpenShift Developer Tools and Services, Red Hat Advanced Cluster Management for Kubernetes 2, … · updated 2026-09-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-81871.json) - **RHSA-2026:68715** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68715) - **RHSA-2026:68716** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68716) - **RHSA-2026:68777** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68777) - **RHSA-2026:68821** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-18 · [advisory](https://access.redhat.com/errata/RHSA-2026:68821) - **RHSA-2026:68926** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-18 · [advisory](https://access.redhat.com/errata/RHSA-2026:68926) - **RHSA-2026:68778** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68778) - **RHSA-2026:68717** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68717) - **RHSA-2026:68729** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68729) - **RHSA-2026:68910** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-18 · [advisory](https://access.redhat.com/errata/RHSA-2026:68910) - **RHSA-2026:68932** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-18 · [advisory](https://access.redhat.com/errata/RHSA-2026:68932) - **RHSA-2026:68941** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-18 · [advisory](https://access.redhat.com/errata/RHSA-2026:68941)