GO-2026-6508
OpenTelemetry-Go: Log gRPC exporter ignores env TLS certs, bypassing mTLS/pinning in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc
At a glance
- Published
- Updated
- CVE
- CVE-2026-81871
- Aliases
- GHSA-w34q-cm8f-9c5x
Description
OpenTelemetry-Go: Log gRPC exporter ignores env TLS certs, bypassing mTLS/pinning in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc
Affected packages
| Package | Versions |
|---|---|
| Go · go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc | introduced 0, fixed 0.21.0 |
References
- https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-w34q-cm8f-9c5x ADVISORY
- https://nvd.nist.gov/vuln/detail/CVE-2026-81871 ADVISORY
- https://github.com/open-telemetry/opentelemetry-go/commit/c65d435b43e5e6b82310e6b18dd4cdcb8ac63a0c WEB
- https://github.com/open-telemetry/opentelemetry-go/releases/tag/exporters/otlp/otlplog/otlploggrpc/v0.21.0 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — Go Vulnerability Database |