Medium, CVSS 6.3GoAmendedPublished
OpenTelemetry-Go: Log gRPC exporter ignores env TLS certs, bypassing mTLS/pinning
CVE-2026-81871 · GHSA-w34q-cm8f-9c5x
- Affected
- Go go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc < 0.21.0
- Fixed in
- 0.21.0· Vendor fix available
- Issue
- The OTLP log gRPC exporter loads TLS settings from environment variables but does not apply them when creating gRPC transport credentials. Operators who rely on OTELEXPORTEROTLPLOGSCERTIFICATE, OTELEXPORTEROTLPCERTIFICATE, or related client certificate variables for CA pinning or mTLS get a connection that falls back to system roots and omits the env-supplied client certificate. A network attacker who can intercept or spoof the collector connection with a system-trusted certificate can read or alter log telemetry. Introduced in commit: d99c76f Details The affected code is in exporters/otlp/otlplog/otlploggrpc. newConfig resolves env-based TLS configuration into cfg.tlsCfg at exporters/otlp/otlplog/otlploggrpc/config.go:106-116. The finding also identifies loadEnvTLS at config.go:451-492 as the code that builds a tls.Config containing RootCAs and client certificates from OTELEXPORTEROTLP[LOGS]CERTIFICATE and OTELEXPORTEROTLP[LOGS]CLIENTCERTIFICATE/KEY. However,…
Recommended action: Upgrade to 0.21.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.