CVE-2026-81871: OpenTelemetry-Go: Log gRPC exporter ignores env TLS certs, bypassing mTLS/pinning
OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.21.0, the exporters/otlp/otlplog/otlploggrpc package loads OTELEXPORTEROTLPLOGSCERTIFICATE, OTELEXPORTEROTLPCERTIFICATE, and related client certificate environment variables through loadEnvTLS into cfg.tlsCfg, but newGRPCDialOptions does not apply cfg.tlsCfg when creating gRPC transport credentials. The environment-only TLS path instead uses credentials.NewTLS with system roots and no configured client certificate, bypassing intended private CA pinning and mutual TLS unless the application also supplies WithTLSCredentials. A network attacker able to intercept or spoof the collector connection with a system-trusted certificate can read or alter log telemetry. This issue is fixed in version 0.21.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenTelemetry-Go (exporters/otlp/otlplog/otlploggrpc)to a version that resolves this vulnerability.Fixed in 0.21.0
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using the OTLP log gRPC exporter before version 0.21.0 are exposed when they rely only on the OTEL_EXPORTER_OTLP_LOGS_CERTIFICATE, OTEL_EXPORTER_OTLP_CERTIFICATE, or related client-certificate environment variables for TLS configuration. Deployments that also explicitly provide WithTLSCredentials are not described as using the affected environment-only path.
What must an attacker be able to do to exploit this?
An attacker must be able to intercept or spoof the connection to the telemetry collector and present a certificate trusted by the system trust store. This can allow the attacker to read or alter exported log telemetry.
Why do private CA pinning and mutual TLS settings fail in affected configurations?
The exporter loads the environment TLS settings into its configuration, but does not apply that TLS configuration when creating gRPC transport credentials. It instead uses system roots and omits the configured client certificate, so private CA and client-certificate settings supplied only through environment variables are bypassed.
What can be done before upgrading?
Explicitly supply TLS credentials with WithTLSCredentials rather than relying solely on the TLS-related environment variables. Upgrade to version 0.21.0 to obtain the fix.