CVE-2026-81871

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-81871
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-81871.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-81871
Aliases
Downstream
AZL (2)
CGA (425)
CLEANSTART (7)
DEBIAN (1)
MINI (95)
openSUSE (6)
RHSA (16)
SUSE (3)
UBUNTU (1)
Related
openSUSE (6)
SUSE (3)
Published
2026-09-16T20:43:40Z
Modified
2026-10-15T10:52:15Z
Severity
  • 6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
OpenTelemetry-Go: Log gRPC exporter ignores env TLS certs, bypassing mTLS/pinning
Details

OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.21.0, the exporters/otlp/otlplog/otlploggrpc package loads OTEL_EXPORTER_OTLP_LOGS_CERTIFICATE, OTEL_EXPORTER_OTLP_CERTIFICATE, and related client certificate environment variables through loadEnvTLS into cfg.tlsCfg, but newGRPCDialOptions does not apply cfg.tlsCfg when creating gRPC transport credentials. The environment-only TLS path instead uses credentials.NewTLS with system roots and no configured client certificate, bypassing intended private CA pinning and mutual TLS unless the application also supplies WithTLSCredentials. A network attacker able to intercept or spoof the collector connection with a system-trusted certificate can read or alter log telemetry. This issue is fixed in version 0.21.0.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-295",
        "CWE-923"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81871.json"
}
References

Affected packages

Git / github.com/open-telemetry/opentelemetry-go

Affected ranges

Type
GIT
Repo
https://github.com/open-telemetry/opentelemetry-go
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
ced177b79530b937530c4f9030ab2115367c5de9
Fixed
c65d435b43e5e6b82310e6b18dd4cdcb8ac63a0c
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "0.21.0"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        },
        {
            "range":  [
                {
                    "fixed":  "c65d435b43e5e6b82310e6b18dd4cdcb8ac63a0c"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

bridge/opencensus/examples/bridge/v0.*
bridge/opencensus/examples/bridge/v0.14.0
bridge/opencensus/v0.*
bridge/opencensus/v0.14.0
bridge/opencensus/v0.15.0
bridge/opencensus/v0.16.0
bridge/opencensus/v0.17.0
bridge/opencensus/v0.18.0
bridge/opencensus/v0.19.0
bridge/opencensus/v0.20.0
bridge/opentracing/v0.*
bridge/opentracing/v0.11.0
bridge/opentracing/v0.12.0
bridge/opentracing/v0.13.0
bridge/opentracing/v0.14.0
bridge/opentracing/v0.15.0
bridge/opentracing/v0.16.0
bridge/opentracing/v0.17.0
bridge/opentracing/v0.18.0
bridge/opentracing/v0.19.0
bridge/opentracing/v0.20.0
example/basic/v0.*
example/basic/v0.10.0
example/basic/v0.11.0
example/basic/v0.12.0
example/basic/v0.13.0
example/basic/v0.14.0
example/basic/v0.15.0
example/basic/v0.2.1
example/basic/v0.2.3
example/basic/v0.3.0
example/basic/v0.4.0
example/basic/v0.4.1
example/basic/v0.4.2
example/basic/v0.4.3
example/basic/v0.6.0
example/basic/v0.7.0
example/basic/v0.8.0
example/basic/v0.9.0
example/grpc/v0.*
example/grpc/v0.10.0
example/grpc/v0.2.1
example/grpc/v0.2.3
example/grpc/v0.3.0
example/grpc/v0.4.0
example/grpc/v0.4.1
example/grpc/v0.4.2
example/grpc/v0.4.3
example/grpc/v0.6.0
example/grpc/v0.7.0
example/grpc/v0.8.0
example/grpc/v0.9.0
example/http-stackdriver/v0.*
example/http-stackdriver/v0.2.1
example/http-stackdriver/v0.2.3
example/http/v0.*
example/http/v0.10.0
example/http/v0.2.1
example/http/v0.2.3
example/http/v0.3.0
example/http/v0.4.0
example/http/v0.4.1
example/http/v0.4.2
example/http/v0.4.3
example/http/v0.6.0
example/http/v0.7.0
example/http/v0.8.0
example/http/v0.9.0
example/jaeger/v0.*
example/jaeger/v0.10.0
example/jaeger/v0.11.0
example/jaeger/v0.12.0
example/jaeger/v0.13.0
example/jaeger/v0.14.0
example/jaeger/v0.15.0
example/jaeger/v0.16.0
example/jaeger/v0.17.0
example/jaeger/v0.18.0
example/jaeger/v0.19.0
example/jaeger/v0.2.1
example/jaeger/v0.2.3
example/jaeger/v0.20.0
example/jaeger/v0.3.0
example/jaeger/v0.4.0
example/jaeger/v0.4.1
example/jaeger/v0.4.2
example/jaeger/v0.4.3
example/jaeger/v0.6.0
example/jaeger/v0.7.0
example/jaeger/v0.8.0
example/jaeger/v0.9.0
example/namedtracer/v0.*
example/namedtracer/v0.10.0
example/namedtracer/v0.11.0
example/namedtracer/v0.12.0
example/namedtracer/v0.13.0
example/namedtracer/v0.14.0
example/namedtracer/v0.15.0
example/namedtracer/v0.16.0
example/namedtracer/v0.17.0
example/namedtracer/v0.18.0
example/namedtracer/v0.19.0
example/namedtracer/v0.2.1
example/namedtracer/v0.2.3
example/namedtracer/v0.20.0
example/namedtracer/v0.3.0
example/namedtracer/v0.4.0
example/namedtracer/v0.4.1
example/namedtracer/v0.4.2
example/namedtracer/v0.4.3
example/namedtracer/v0.6.0
example/namedtracer/v0.7.0
example/namedtracer/v0.8.0
example/namedtracer/v0.9.0
example/opencensus/v0.*
example/opencensus/v0.15.0
example/opencensus/v0.16.0
example/opencensus/v0.17.0
example/opencensus/v0.18.0
example/opencensus/v0.19.0
example/opencensus/v0.20.0
example/otel-collector/v0.*
example/otel-collector/v0.10.0
example/otel-collector/v0.11.0
example/otel-collector/v0.12.0
example/otel-collector/v0.13.0
example/otel-collector/v0.14.0
example/otel-collector/v0.15.0
example/otel-collector/v0.16.0
example/otel-collector/v0.17.0
example/otel-collector/v0.18.0
example/otel-collector/v0.19.0
example/otel-collector/v0.20.0
example/otel-collector/v0.6.0
example/otel-collector/v0.7.0
example/otel-collector/v0.8.0
example/otel-collector/v0.9.0
example/prom-collector/v0.*
example/prom-collector/v0.16.0
example/prom-collector/v0.17.0
example/prom-collector/v0.18.0
example/prom-collector/v0.19.0
example/prom-collector/v0.20.0
example/prometheus/v0.*
example/prometheus/v0.10.0
example/prometheus/v0.11.0
example/prometheus/v0.12.0
example/prometheus/v0.13.0
example/prometheus/v0.14.0
example/prometheus/v0.15.0
example/prometheus/v0.16.0
example/prometheus/v0.17.0
example/prometheus/v0.18.0
example/prometheus/v0.19.0
example/prometheus/v0.2.1
example/prometheus/v0.2.3
example/prometheus/v0.20.0
example/prometheus/v0.3.0
example/prometheus/v0.4.0
example/prometheus/v0.4.1
example/prometheus/v0.4.2
example/prometheus/v0.4.3
example/prometheus/v0.6.0
example/prometheus/v0.7.0
example/prometheus/v0.8.0
example/prometheus/v0.9.0
example/zipkin/v0.*
example/zipkin/v0.10.0
example/zipkin/v0.11.0
example/zipkin/v0.12.0
example/zipkin/v0.13.0
example/zipkin/v0.14.0
example/zipkin/v0.15.0
example/zipkin/v0.16.0
example/zipkin/v0.17.0
example/zipkin/v0.18.0
example/zipkin/v0.19.0
example/zipkin/v0.20.0
example/zipkin/v0.3.0
example/zipkin/v0.4.0
example/zipkin/v0.4.1
example/zipkin/v0.4.2
example/zipkin/v0.4.3
example/zipkin/v0.6.0
example/zipkin/v0.7.0
example/zipkin/v0.8.0
example/zipkin/v0.9.0
exporter/metric/prometheus/v0.*
exporter/metric/prometheus/v0.2.0
exporter/metric/prometheus/v0.2.1
exporter/trace/jaeger/v0.*
exporter/trace/jaeger/v0.1.1
exporter/trace/jaeger/v0.1.2
exporter/trace/jaeger/v0.2.0
exporter/trace/jaeger/v0.2.1
exporter/trace/stackdriver/v0.*
exporter/trace/stackdriver/v0.1.1
exporter/trace/stackdriver/v0.1.2
exporter/trace/stackdriver/v0.2.0
exporter/trace/stackdriver/v0.2.1
exporter/trace/stdout/v0.*
exporter/trace/stdout/v0.1.1
exporter/trace/stdout/v0.1.2
exporters/metric/prometheus/v0.*
exporters/metric/prometheus/v0.10.0
exporters/metric/prometheus/v0.11.0
exporters/metric/prometheus/v0.12.0
exporters/metric/prometheus/v0.13.0
exporters/metric/prometheus/v0.14.0
exporters/metric/prometheus/v0.15.0
exporters/metric/prometheus/v0.16.0
exporters/metric/prometheus/v0.17.0
exporters/metric/prometheus/v0.18.0
exporters/metric/prometheus/v0.19.0
exporters/metric/prometheus/v0.2.3
exporters/metric/prometheus/v0.20.0
exporters/metric/prometheus/v0.3.0
exporters/metric/prometheus/v0.4.0
exporters/metric/prometheus/v0.4.1
exporters/metric/prometheus/v0.4.2
exporters/metric/prometheus/v0.4.3
exporters/metric/prometheus/v0.6.0
exporters/metric/prometheus/v0.7.0
exporters/metric/prometheus/v0.8.0
exporters/metric/prometheus/v0.9.0
exporters/otlp/v0.*
exporters/otlp/v0.10.0
exporters/otlp/v0.11.0
exporters/otlp/v0.12.0
exporters/otlp/v0.13.0
exporters/otlp/v0.14.0
exporters/otlp/v0.15.0
exporters/otlp/v0.16.0
exporters/otlp/v0.17.0
exporters/otlp/v0.18.0
exporters/otlp/v0.19.0
exporters/otlp/v0.20.0
exporters/otlp/v0.3.0
exporters/otlp/v0.4.0
exporters/otlp/v0.4.1
exporters/otlp/v0.4.2
exporters/otlp/v0.4.3
exporters/otlp/v0.6.0
exporters/otlp/v0.7.0
exporters/otlp/v0.8.0
exporters/otlp/v0.9.0
exporters/stdout/v0.*
exporters/stdout/v0.10.0
exporters/stdout/v0.11.0
exporters/stdout/v0.12.0
exporters/stdout/v0.13.0
exporters/stdout/v0.14.0
exporters/stdout/v0.15.0
exporters/stdout/v0.16.0
exporters/stdout/v0.17.0
exporters/stdout/v0.18.0
exporters/stdout/v0.19.0
exporters/stdout/v0.20.0
exporters/trace/jaeger/v0.*
exporters/trace/jaeger/v0.10.0
exporters/trace/jaeger/v0.11.0
exporters/trace/jaeger/v0.12.0
exporters/trace/jaeger/v0.13.0
exporters/trace/jaeger/v0.14.0
exporters/trace/jaeger/v0.15.0
exporters/trace/jaeger/v0.16.0
exporters/trace/jaeger/v0.17.0
exporters/trace/jaeger/v0.18.0
exporters/trace/jaeger/v0.19.0
exporters/trace/jaeger/v0.2.3
exporters/trace/jaeger/v0.20.0
exporters/trace/jaeger/v0.3.0
exporters/trace/jaeger/v0.4.0
exporters/trace/jaeger/v0.4.1
exporters/trace/jaeger/v0.4.2
exporters/trace/jaeger/v0.4.3
exporters/trace/jaeger/v0.6.0
exporters/trace/jaeger/v0.7.0
exporters/trace/jaeger/v0.8.0
exporters/trace/jaeger/v0.9.0
exporters/trace/stackdriver/v0.*
exporters/trace/stackdriver/v0.2.3
exporters/trace/zipkin/v0.*
exporters/trace/zipkin/v0.10.0
exporters/trace/zipkin/v0.11.0
exporters/trace/zipkin/v0.12.0
exporters/trace/zipkin/v0.13.0
exporters/trace/zipkin/v0.14.0
exporters/trace/zipkin/v0.15.0
exporters/trace/zipkin/v0.16.0
exporters/trace/zipkin/v0.17.0
exporters/trace/zipkin/v0.18.0
exporters/trace/zipkin/v0.19.0
exporters/trace/zipkin/v0.20.0
exporters/trace/zipkin/v0.3.0
exporters/trace/zipkin/v0.4.0
exporters/trace/zipkin/v0.4.1
exporters/trace/zipkin/v0.4.2
exporters/trace/zipkin/v0.4.3
exporters/trace/zipkin/v0.6.0
exporters/trace/zipkin/v0.7.0
exporters/trace/zipkin/v0.8.0
exporters/trace/zipkin/v0.9.0
metric/v0.*
metric/v0.17.0
metric/v0.18.0
metric/v0.19.0
metric/v0.20.0
oteltest/v0.*
oteltest/v0.17.0
oteltest/v0.18.0
oteltest/v0.19.0
oteltest/v0.20.0
sdk/export/metric/v0.*
sdk/export/metric/v0.17.0
sdk/export/metric/v0.18.0
sdk/export/metric/v0.19.0
sdk/export/metric/v0.20.0
sdk/metric/v0.*
sdk/metric/v0.17.0
sdk/metric/v0.18.0
sdk/metric/v0.19.0
sdk/metric/v0.20.0
sdk/v0.*
sdk/v0.10.0
sdk/v0.11.0
sdk/v0.12.0
sdk/v0.13.0
sdk/v0.14.0
sdk/v0.15.0
sdk/v0.16.0
sdk/v0.17.0
sdk/v0.18.0
sdk/v0.19.0
sdk/v0.20.0
tools/v0.*
tools/v0.2.3
trace/v0.*
trace/v0.17.0
trace/v0.18.0
trace/v0.19.0
trace/v0.20.0
v0.*
v0.1.1
v0.1.2
v0.10.0
v0.11.0
v0.12.0
v0.13.0
v0.14.0
v0.15.0
v0.16.0
v0.17.0
v0.18.0
v0.19.0
v0.2.0
v0.2.1
v0.2.1.1
v0.2.2
v0.2.3
v0.20.0
v0.3.0
v0.4.0
v0.4.1
v0.4.2
v0.4.3
v0.6.0
v0.7.0
v0.8.0
v0.9.0

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-81871.json"