CVE-2026-81871
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc: OpenTelemetry-Go: TLS certificate bypass allows log telemetry interception and alteration
Severity
ModerateRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · September 17, 2026
Updated · October 15, 2026
Description
A flaw was found in OpenTelemetry-Go, specifically within its gRPC log exporter. This vulnerability allows a network attacker to bypass the intended private Certificate Authority (CA) pinning and mutual Transport Layer Security (TLS) configurations. The issue arises because the environment-only TLS path incorrectly uses system-trusted certificates instead of the application's configured client certificates. This bypass enables an attacker to intercept and spoof the collector connection, potentially leading to the unauthorized reading or alteration of sensitive log telemetry.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CWE-295 · Improper Certificate Validation