Skip to content
Fencer Vulns
medium 6.3

CVE-2026-81871 json

OpenTelemetry-Go: Log gRPC exporter ignores env TLS certs, bypassing mTLS/pinning

published 2026-09-16 53 d ago modified 2026-09-30 39 d ago also GHSA-w34q-cm8f-9c5x , GO-2026-6508 , EUVD-2026-81262

cvss
6.3
version 4.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 9%
public exploits
0
none known

Summary

OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.21.0, the exporters/otlp/otlplog/otlploggrpc package loads OTEL_EXPORTER_OTLP_LOGS_CERTIFICATE, OTEL_EXPORTER_OTLP_CERTIFICATE, and related client certificate environment variables through loadEnvTLS into cfg.tlsCfg, but newGRPCDialOptions does not apply cfg.tlsCfg when creating gRPC transport credentials. The environment-only TLS path instead uses credentials.NewTLS with system roots and no configured client certificate, bypassing intended private CA pinning and mutual TLS unless the application also supplies WithTLSCredentials. A network attacker able to intercept or spoof the collector connection with a system-trusted certificate can read or alter log telemetry. This issue is fixed in version 0.21.0.

Patch / fix

  • go go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc 0.21.0
  • opentofu1.12 hummingbird 1 1.12.7-0.1.hum1
  • caddy hummingbird 1 2.11.6-0.1.hum1
  • loki3.7 hummingbird 1 3.7.8-0.2.hum1
  • loki3.7-canary hummingbird 1 3.7.8-0.2.hum1
  • loki3.7-logcli hummingbird 1 3.7.8-0.2.hum1
  • loki3.6 hummingbird 1 3.6.17-0.2.hum1
  • loki3.6-canary hummingbird 1 3.6.17-0.2.hum1
  • loki3.6-logcli hummingbird 1 3.6.17-0.2.hum1

red hat advisories RHSA-2026:74948RHSA-2026:74865RHSA-2026:68941RHSA-2026:68932RHSA-2026:68912RHSA-2026:68926

  • helm SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +10 more 3.22.1-150000.1.104.1
  • helm Linux Micro 6.1 4.3.0-slfo.1.1_1.1
  • distribution SLES for SAP applications 16.0, SLES 16.0 3.1.1-160000.4.1
  • helm SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 4.3.0-160000.1.1

suse advisories SUSE-SU-2026:5119-1SUSE-SU-2026:24282-1SUSE-SU-2026:23990-1SUSE-SU-2026:23973-1SUSE-SU-2026:23984-1

  • alloy openSUSE Tumbleweed 1.20.1-1.1
  • distribution openSUSE Leap 16.0 3.1.1-160000.4.1
  • helm openSUSE Leap 16.0 4.3.0-160000.1.1
  • helm3 openSUSE Tumbleweed 3.22.0-2.1
  • distribution openSUSE Tumbleweed 3.1.1-8.1
  • helm openSUSE Tumbleweed 4.3.0-3.1

opensuse advisories openSUSE-SU-2026:12114-1openSUSE-SU-2026:22010-1openSUSE-SU-2026:21983-1openSUSE-SU-2026:11892-1openSUSE-SU-2026:11872-1openSUSE-SU-2026:11875-1

  • azurelinux-image-tools Azure Linux 3.0 1.7.0-2

azure linux advisories AZL-103110

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-81871 updated cvss 6.5

go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc: OpenTelemetry-Go: TLS certificate bypass allows log telemetry interception and alteration

  • Red Hat Assisted Installer for Red Hat OpenShift Container Platform 2 assisted/agent-preinstall-image-builder-rhel9 Red Hat Logging Subsystem for Red Hat OpenShift openshift-logging/logging-loki-rhel9, openshift-logging/loki-rhel9-operator
    affected: no fix planned “Out of support scope”
  • Red Hat Multiarch Tuning Operator multiarch-tuning/multiarch-tuning-rhel9-operator, multiarch-tuning/multiarch-tuning-operator-bundle Red Hat Multicluster Engine for Kubernetes multicluster-engine/maestro-rhel9, multicluster-engine/cloudevents-conductor-rhel9 Red Hat Multicluster Global Hub multicluster-globalhub/multicluster-globalhub-grafana-rhel9
    affected: no fix available “Fix deferred”
  • Red Hat OpenShift Developer Tools and Services helm 3.20.2.1-77.el9
    affected: no fix planned “Out of support scope”
  • Red Hat OpenShift Lightspeed openshift-lightspeed/otelcol-lightspeed-rhel9, openshift-lightspeed/lightspeed-agentic-rhel9-operator
    affected: no fix available “Fix deferred”
  • Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/acm-grafana-rhel9, rhacm2/multicluster-operators-subscription-rhel9, rhacm2/acm-multicluster-observability-addon-rhel9
    affected: no fix available, no fix planned “Out of support scope”
  • Red Hat Ceph Storage 5 rhceph/rhceph-5-dashboard-rhel8 Red Hat Ceph Storage 6 rhceph/rhceph-6-dashboard-rhel9
    affected: no fix planned “Out of support scope”
  • Red Hat Ceph Storage 7 rhceph/grafana-rhel9 Red Hat Ceph Storage 8 rhceph/grafana-rhel9
    affected: no fix available “Fix deferred”
  • Red Hat Ceph Storage 9 rhceph/alloy-rhel10, rhceph/grafana-rhel10
    affected: no fix available, no fix planned “Out of support scope”
show 5 more
  • Red Hat Connectivity Link 1 rhcl-1/rhcl-rhel9-operator, rhcl-1/rhcl-operator-bundle, rhcl-tech-preview/mcp-gateway-rhel9, rhcl-tech-preview/mcp-gateway-rhel9-operator Red Hat Edge Manager 1 flightctl 1.2.0-1.el10, rhem/flightctl-api-rhel9, rhem/flightctl-api-rhel10, rhem/flightctl-worker-rhel9, rhem/flightctl-worker-rhel10, rhem/flightctl-db-setup-rhel9, +19 more Red Hat Enterprise Linux 9 opentelemetry-collector, opentelemetry-collector 0.152.1-2.el10_2 Red Hat Enterprise Linux 10 grafana 12.4.3-2.el10, opentelemetry-collector 0.152.1-2.el10_2
    affected: no fix available “Fix deferred”
  • Red Hat Hardened Images opentofu1.11 1.11.14-0.1.hum1
    affected: no fix planned “Will not fix”
  • Red Hat OpenShift AI (RHOAI) rhoai/odh-eval-hub-rhel9 Red Hat OpenShift Container Platform 4 openshift4/oc-mirror-plugin-rhel9, openshift4/ose-helm-rhel9-operator Red Hat OpenShift Container Platform 5 openshift5/oc-mirror-plugin-rhel9, openshift5/ose-helm-rhel9-operator Red Hat OpenShift Dev Spaces devspaces/traefik-rhel9 Red Hat OpenShift distributed tracing 3 rhosdt/tempo-rhel9, rhosdt/tempo-query-rhel9, rhosdt/tempo-jaeger-query-rhel9, rhosdt/opentelemetry-rhel9-operator, rhosdt/opentelemetry-collector-rhel9, rhosdt/opentelemetry-target-allocator-rhel9 Red Hat OpenShift GitOps openshift-gitops-1/argocd-rhel8, openshift-gitops-1/argocd-rhel9
    +1 more products
    Red Hat OpenStack Platform 18.0 rhoso-operators/openstack-operator-bundle
    affected: no fix available “Fix deferred”
  • Red Hat Hardened Images helm4 4.3.0-0.2.hum1, caddy 2.11.4-0.4.hum1, caddy 2.11.6-0.1.hum1, helm3 3.22.0-0.2.hum1, jaeger 2.20.0-0.9.hum1, loki3.7 3.7.8-0.2.hum1, +14 more
    fixed: vendor fix RHSA-2026:68715
  • Red Hat Hardened Images opentelemetry-collector 0.152.1-2.el10_2, opentelemetry-collector-k8s 0.160.0-0.1.hum1, opentelemetry-collector-contrib 0.160.0-0.1.hum1
    not affected: component not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
52 d ago

Exploit prediction

0.20% chance of exploitation in the next 30 days, higher than 9% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 4.0 6.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
CNA 4.0 6.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected packages

ecosystem package affected fixed in
go go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc
<0.21.0
0.21.0

Affected products

  • open-telemetry opentelemetry-go

Classification

Weakness
  • CWE-295 Improper Certificate Validation
  • CWE-923 Improper Restriction of Communication Channel to Intended Endpoints

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.