CVE-2026-81871 OpenTelemetry-Go: Log gRPC exporter ignores env TLS certs, bypassing mTLS/pinning
Attacker can intercept or alter log telemetry by bypassing mTLS and certificate pinning when using environment-based TLS configuration in OpenTelemetry-Go.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-81871?
CVE-2026-81871 is a medium-severity vulnerability in open-telemetry opentelemetry-go, published on 16 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.21.0, the exporters/otlp/otlplog/otlploggrpc package loads OTEL_EXPORTER_OTLP_LOGS_CERTIFICATE, OTEL_EXPORTER_OTLP_CERTIFICATE, and related client certificate environment variables through loadEnvTLS into cfg.tlsCfg, but newGRPCDialOptions does not apply cfg.tlsCfg when creating gRPC transport credentials. The environment-only TLS path instead uses credentials.NewTLS with system roots and no configured client certificate, bypassing intended private CA pinning and mutual TLS unless the application also supplies WithTLSCredentials. A network attacker able to intercept or spoof the collector connection with a system-trusted certificate can read or alter log telemetry. This issue is fixed in version 0.21.0.
Which versions are affected by CVE-2026-81871?
3 open source packages ship an affected version, including go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc.
| Package | Affected | Fixed in |
|---|---|---|
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc Go | All versions | 0.21.0 |
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc Go | All versions | 0.21.0 |
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc Go | All versions | 0.21.0 |
Linux distribution packages (9)
caddy Red Hat:hummingbird:1 | All versions | 0:2.11.6-0.1.hum1 |
loki3.6 Red Hat:hummingbird:1 | All versions | 0:3.6.17-0.2.hum1 |
loki3.6-canary Red Hat:hummingbird:1 | All versions | 0:3.6.17-0.2.hum1 |
loki3.6-logcli Red Hat:hummingbird:1 | All versions | 0:3.6.17-0.2.hum1 |
loki3.7 Red Hat:hummingbird:1 | All versions | 0:3.7.8-0.2.hum1 |
loki3.7-canary Red Hat:hummingbird:1 | All versions | 0:3.7.8-0.2.hum1 |
loki3.7-logcli Red Hat:hummingbird:1 | All versions | 0:3.7.8-0.2.hum1 |
tempo2.10 Red Hat:hummingbird:1 | All versions | 0:2.10.8-0.3.hum1 |
tempo3.0 Red Hat:hummingbird:1 | All versions | 0:3.0.3-0.3.hum1 |
How do I fix CVE-2026-81871?
Upgrade go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc to 0.21.0 or later.
Is CVE-2026-81871 being exploited?
There is no known exploitation of CVE-2026-81871 in the wild and no public exploit code.
Sources
Also known as AZL-103056, AZL-103110, CLEANSTART-2026-BF89402, CLEANSTART-2026-JK20975, CLEANSTART-2026-LW29584, CLEANSTART-2026-MT48554 and 113 more.