CVE-2026-81871

Name of the Vulnerable Software and Affected Versions OpenTelemetry-Go versions prior to 0.21.0

Description The exporters/otlp/otlplog/otlploggrpc package loads TLS settings from environment variables into cfg.tlsCfg using the loadEnvTLS() function, but the newGRPCDialOptions() function fails to apply this configuration when creating gRPC transport credentials. This causes the connection to fall back to system root CAs and omit the client certificate, bypassing intended mutual TLS (mTLS) and private CA pinning. A network attacker capable of intercepting or spoofing the collector connection using a system-trusted certificate can read or alter log telemetry. This occurs when the application relies solely on environment variables such as OTEL EXPORTER OTLP LOGS CERTIFICATE and OTEL EXPORTER OTLP CERTIFICATE without explicitly providing WithTLSCredentials.

Recommendations Update OpenTelemetry-Go to version 0.21.0. As a temporary workaround, explicitly supply WithTLSCredentials to ensure the intended TLS configuration is applied.