Certificate Bypass Vulnerability in OpenTelemetry-Go by OpenTelemetry
CVE-2026-81871

6.3MEDIUM

Key Information:

Vendor

Open-telemetry

Status
Opentelemetry-go
Vendor
CVE Published:
16 September 2026

What is CVE-2026-81871?

The vulnerability in OpenTelemetry-Go involves the improper handling of TLS configurations within the exporters/otlp/otlplog/otlploggrpc package. Specifically, prior to version 0.21.0, the application fails to apply user-defined TLS settings when establishing gRPC transport credentials. As a result, applications may inadvertently rely on system-trusted certificates, enabling an attacker to potentially intercept or manipulate log telemetry data. The issue has been addressed in version 0.21.0, which ensures that proper client certificates and private CA pinning are applied during gRPC connections.

Affected Version(s)

opentelemetry-go < 0.21.0

References

https://github.com/open-telemetry/opentelemetry-go/securi...
x_refsource_CONFIRM
https://github.com/open-telemetry/opentelemetry-go/commit...
x_refsource_MISC
https://github.com/open-telemetry/opentelemetry-go/releas...
x_refsource_MISC

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.