OpenTelemetry-Go: Log gRPC exporter ignores env TLS certs, bypassing mTLS/pinning
Priority LOW 27CWE-295Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- Spoofing
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Partial Red Hat: 1 fixed, 25 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-295.
Summary
OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.21.0, the exporters/otlp/otlplog/otlploggrpc package loads OTEL_EXPORTER_OTLP_LOGS_CERTIFICATE, OTEL_EXPORTER_OTLP_CERTIFICATE, and related client certificate environment variables through loadEnvTLS into cfg.tlsCfg, but newGRPCDialOptions does not apply cfg.tlsCfg when creating gRPC transport credentials. The environment-only TLS path instead uses credentials.NewTLS with system roots and no configured client certificate, bypassing intended private CA pinning and mutual TLS unless the application also supplies WithTLSCredentials. A network attacker able to intercept or spoof the collector connection with a system-trusted certificate can read or alter log telemetry. This issue is fixed in version 0.21.0.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00196 9th percentileScored 2026-11-07
Fix Partial opentelemetry-go (open-telemetry): 0.21.0go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc (Go): 0.21.0Red Hat: 16 advisoriesRed Hat: 1 fixed, 25 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| open-telemetry | opentelemetry-go | before 0.21.0 | 0.21.0 | Patch available | CNA |
| — | go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc (Go) | before 0.21.0 | 0.21.0 | Patch available | GHSA-w34q-cm8f-9c5x |
- opentelemetry-go Vendoropen-telemetry Affected before 0.21.0 Fixed in 0.21.0 Patch available CNA
- go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc (Go) Vendor— Affected before 0.21.0 Fixed in 0.21.0 Patch available GHSA-w34q-cm8f-9c5x
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:opentelemetry:opentelemetry:*:*:*:*:*:*:*:* | — | — | open-telemetry |
- cpe:2.3:a:opentelemetry:opentelemetry:*:*:*:*:*:*:*:* Versions — — ·open-telemetry
Remediation
- Fix · CNA opentelemetry-go (open-telemetry) Fixed in 0.21.0
- Fix · GHSA-w34q-cm8f-9c5x go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc (Go) Fixed in 0.21.0 Advisory →
Red Hat 16 advisories
- RHSA-2026:74948 Released 2026-10-02 · Red Hat rating ImportantRed Hat Hardened Images RPMs Security Update
- Red Hat Hardened Images opentofu1.12-1.12.7-0.1.hum1@aarch64, opentofu1.12-1.12.7-0.1.hum1@src, opentofu1.12-1.12.7-0.1.hum1@x86_64
- RHSA-2026:74865 Released 2026-10-02 · Red Hat rating ModerateRed Hat Hardened Images RPMs Security Update
- Red Hat Hardened Images caddy-2.11.6-0.1.hum1@aarch64, caddy-2.11.6-0.1.hum1@src, caddy-2.11.6-0.1.hum1@x86_64
- RHSA-2026:68941 Released 2026-09-18 · Red Hat rating ModerateRed Hat Hardened Images RPMs Security Update
- Red Hat Hardened Images loki3.7-3.7.8-0.2.hum1@aarch64, loki3.7-3.7.8-0.2.hum1@src, loki3.7-3.7.8-0.2.hum1@x86_64 +4
Show 13 more Red Hat advisories
- RHSA-2026:68932 Released 2026-09-18 · Red Hat rating ModerateRed Hat Hardened Images RPMs Security Update
- Red Hat Hardened Images loki3.6-3.6.17-0.2.hum1@aarch64, loki3.6-3.6.17-0.2.hum1@src, loki3.6-3.6.17-0.2.hum1@x86_64 +4
- RHSA-2026:68926 Released 2026-09-18 · Red Hat rating ImportantRed Hat Hardened Images RPMs Security Update
- Red Hat Hardened Images grafana13.1-13.1.6-0.2.hum1@aarch64, grafana13.1-13.1.6-0.2.hum1@src, grafana13.1-13.1.6-0.2.hum1@x86_64
- RHSA-2026:68912 Released 2026-09-18 · Red Hat rating ModerateRed Hat Hardened Images RPMs Security Update
- Red Hat Hardened Images tempo3.0-3.0.3-0.3.hum1@aarch64, tempo3.0-3.0.3-0.3.hum1@src, tempo3.0-3.0.3-0.3.hum1@x86_64
- RHSA-2026:68910 Released 2026-09-18 · Red Hat rating ModerateRed Hat Hardened Images RPMs Security Update
- Red Hat Hardened Images jaeger-2.20.0-0.9.hum1@aarch64, jaeger-2.20.0-0.9.hum1@src, jaeger-2.20.0-0.9.hum1@x86_64
- RHSA-2026:68905 Released 2026-09-18 · Red Hat rating ModerateRed Hat Hardened Images RPMs Security Update
- Red Hat Hardened Images opentofu1.12-1.12.6-0.3.hum1@aarch64, opentofu1.12-1.12.6-0.3.hum1@src, opentofu1.12-1.12.6-0.3.hum1@x86_64
- RHSA-2026:68903 Released 2026-09-18 · Red Hat rating ModerateRed Hat Hardened Images RPMs Security Update
- Red Hat Hardened Images tempo2.10-2.10.8-0.3.hum1@aarch64, tempo2.10-2.10.8-0.3.hum1@src, tempo2.10-2.10.8-0.3.hum1@x86_64
- RHSA-2026:68821 Released 2026-09-18 · Red Hat rating ImportantRed Hat Hardened Images RPMs Security Update
- Red Hat Hardened Images grafana12.4-12.4.10-0.6.hum1@aarch64, grafana12.4-12.4.10-0.6.hum1@src, grafana12.4-12.4.10-0.6.hum1@x86_64
- RHSA-2026:68778 Released 2026-09-17 · Red Hat rating ImportantRed Hat Hardened Images RPMs Security Update
- Red Hat Hardened Images grafana13.2-13.2.1-0.5.hum1@aarch64, grafana13.2-13.2.1-0.5.hum1@src, grafana13.2-13.2.1-0.5.hum1@x86_64
- RHSA-2026:68777 Released 2026-09-17 · Red Hat rating ModerateRed Hat Hardened Images RPMs Security Update
- Red Hat Hardened Images grafana12.4-12.4.10-0.5.hum1@aarch64, grafana12.4-12.4.10-0.5.hum1@src, grafana12.4-12.4.10-0.5.hum1@x86_64
- RHSA-2026:68729 Released 2026-09-17 · Red Hat rating ImportantRed Hat Hardened Images RPMs Security Update
- Red Hat Hardened Images helm4-4.3.0-0.2.hum1@aarch64, helm4-4.3.0-0.2.hum1@src, helm4-4.3.0-0.2.hum1@x86_64
- RHSA-2026:68717 Released 2026-09-17 · Red Hat rating ImportantRed Hat Hardened Images RPMs Security Update
- Red Hat Hardened Images helm3-3.22.0-0.2.hum1@aarch64, helm3-3.22.0-0.2.hum1@src, helm3-3.22.0-0.2.hum1@x86_64
- RHSA-2026:68716 Released 2026-09-17 · Red Hat rating ModerateRed Hat Hardened Images RPMs Security Update
- Red Hat Hardened Images distribution-3.1.1-0.2.hum1@aarch64, distribution-3.1.1-0.2.hum1@src, distribution-3.1.1-0.2.hum1@x86_64
- RHSA-2026:68715 Released 2026-09-17 · Red Hat rating ModerateRed Hat Hardened Images RPMs Security Update
- Red Hat Hardened Images caddy-2.11.4-0.4.hum1@aarch64, caddy-2.11.4-0.4.hum1@src, caddy-2.11.4-0.4.hum1@x86_64
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Assisted Installer for Red Hat OpenShift Container Platform 2 | Affected | No fix planned: Out of support scope |
| Logging Subsystem for Red Hat OpenShift | Affected | No fix planned: Out of support scope |
| Multiarch Tuning Operator | Affected | No fix yet: Fix deferred |
| Multicluster Engine for Kubernetes | Affected | No fix yet: Fix deferred |
| Multicluster Global Hub | Affected | No fix yet: Fix deferred |
| OpenShift Developer Tools and Services | Affected | No fix planned: Out of support scope |
| OpenShift Lightspeed | Affected | No fix yet: Fix deferred |
| Red Hat Advanced Cluster Management for Kubernetes 2 | Affected | No fix yet: Fix deferred |
| Red Hat Ceph Storage 5 | Affected | No fix planned: Out of support scope |
| Red Hat Ceph Storage 6 | Affected | No fix planned: Out of support scope |
| Red Hat Ceph Storage 7 | Affected | No fix yet: Fix deferred |
| Red Hat Ceph Storage 8 | Affected | No fix yet: Fix deferred |
| Red Hat Ceph Storage 9 | Affected | No fix yet: Fix deferred |
| Red Hat Connectivity Link 1 | Affected | No fix yet: Fix deferred |
| Red Hat Edge Manager 1 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 10 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 9 | Affected | No fix yet: Fix deferred |
| Red Hat Hardened Images | Affected | No fix planned: Will not fix |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Container Platform 5 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Dev Spaces | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift GitOps | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift distributed tracing 3 | Affected | No fix yet: Fix deferred |
| Red Hat OpenStack Platform 18.0 | Affected | No fix yet: Fix deferred |
| Red Hat Hardened Images | Fixed | RHSA-2026:68715, RHSA-2026:68716, RHSA-2026:68717, RHSA-2026:68729, RHSA-2026:68777, RHSA-2026:68778, RHSA-2026:68821, RHSA-2026:68903, RHSA-2026:68905, RHSA-2026:68910, RHSA-2026:68912, RHSA-2026:68926, RHSA-2026:68932, RHSA-2026:68941, RHSA-2026:74865, RHSA-2026:74948 |
Not affected: 1 product
- Red Hat Hardened Images
Timeline
- 2026-10-02 Threatist record created from CVE-2026-81871
- 2026-10-03 Alias added: GHSA-w34q-cm8f-9c5x
- 2026-11-06 Affected versions changed · Red Hat
References
Other 4
- https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-w34q-cm8f-9c5x
- https://github.com/open-telemetry/opentelemetry-go/commit/c65d435b43e5e6b82310e6b18dd4cdcb8ac63a0c
- https://github.com/open-telemetry/opentelemetry-go/releases/tag/exporters/otlp/otlplog/otlploggrpc/v0.21.0
- https://github.com/open-telemetry/opentelemetry-go
More open-telemetry vulnerabilities
- TI-2024-23957 OpenTelemetry Collector has a Denial of Service via Zip/Decompression Bomb sent over HTTP or gRPC CVSS 3.1HIGH 8.2
- TI-2026-42706 OpenTelemetry JavaScript: Denial of service in `JaegerPropagator` via unhandled exception on a malformed header CVSS 3.1HIGH 7.5
- TI-2026-33428 OpenTelemetry eBPF Instrumentation: Memcached payload length overflow can crash OBI CVSS 3.1HIGH 7.5
- TI-2026-33427 OpenTelemetry eBPF Instrumentation: MongoDB parser panics on malformed wire messages CVSS 3.1HIGH 7.5
- TI-2026-33420 OpenTelemetry eBPF Instrumentation: Postgres BIND parsing can panic on malformed payloads CVSS 3.1HIGH 7.5
- TI-2026-32777 opentelemetry-js: Prometheus exporter process crash via malformed HTTP request CVSS 3.1HIGH 7.5
Sources
- CVE-2026-81871 · CVE Program
- CVE-2026-81871 · NVD
- FIRST EPSS
- GHSA-w34q-cm8f-9c5x · GitHub Advisory Database · CC BY 4.0
- CVE-2026-81871 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences