{"id":"EUVD-2026-81262","revision":"c59044ffd72a4255b912e393ce99bc1e","records":[{"revision":"c59044ffd72a4255b912e393ce99bc1e","observedAt":"2026-10-28T09:44:47.51+00:00","statement":{"source":"euvd","id":"EUVD-2026-81262","aliases":["CVE-2026-81871","GHSA-w34q-cm8f-9c5x"],"title":"OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.21.0, the exporters/otlp/otlplog/otlploggrpc package loads OTEL_EXPORTER_OTLP_LOGS_CERTIFICATE, OTEL_EXPORTER_OTLP_CERTIFICATE, and related client certificate en…","description":"OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.21.0, the exporters/otlp/otlplog/otlploggrpc package loads OTEL_EXPORTER_OTLP_LOGS_CERTIFICATE, OTEL_EXPORTER_OTLP_CERTIFICATE, and related client certificate environment variables through loadEnvTLS into cfg.tlsCfg, but newGRPCDialOptions does not apply cfg.tlsCfg when creating gRPC transport credentials. The environment-only TLS path instead uses credentials.NewTLS with system roots and no configured client certificate, bypassing intended private CA pinning and mutual TLS unless the application also supplies WithTLSCredentials. A network attacker able to intercept or spoof the collector connection with a system-trusted certificate can read or alter log telemetry. This issue is fixed in version 0.21.0.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","score":6.3,"severity":null}],"references":["https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-w34q-cm8f-9c5x","https://github.com/open-telemetry/opentelemetry-go/commit/c65d435b43e5e6b82310e6b18dd4cdcb8ac63a0c","https://github.com/open-telemetry/opentelemetry-go/releases/tag/exporters/otlp/otlplog/otlploggrpc/v0.21.0"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-81262","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Sep 16, 2026, 8:43:40 PM","dateUpdated":"Sep 17, 2026, 7:24:00 PM"},"relatedAdvisories":[{"id":"RHSA-2026:68729","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","vulnerabilityIds":["CVE-2026-56851","CVE-2026-63209","CVE-2026-81871","CVE-2026-81872","CVE-2026-93450"]},{"id":"RHSA-2026:68932","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","vulnerabilityIds":["CVE-2026-81871"]},{"id":"RHSA-2026:68926","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","vulnerabilityIds":["CVE-2026-14199","CVE-2026-81871","CVE-2026-81872","CVE-2026-92599"]},{"id":"openSUSE-SU-2026:11875-1","title":"helm-4.3.0-3.1 on GA media","vulnerabilityIds":["CVE-2026-81871","CVE-2026-81872"]},{"id":"openSUSE-SU-2026:22010-1","title":"Security update for distribution","vulnerabilityIds":["CVE-2026-81871","CVE-2026-81872"]},{"id":"msrc_CVE-2026-81871","title":"OpenTelemetry-Go: Log gRPC exporter ignores env TLS certs, bypassing mTLS/pinning","vulnerabilityIds":["CVE-2026-81871"]},{"id":"SUSE-SU-2026:23984-1","title":"Security update for helm","vulnerabilityIds":["CVE-2026-33814","CVE-2026-35204","CVE-2026-35205","CVE-2026-35206","CVE-2026-41178","CVE-2026-41888","CVE-2026-48978","CVE-2026-50151","CVE-2026-50163","CVE-2026-56852","CVE-2026-56854","CVE-2026-56855","CVE-2026-56864","CVE-2026-56865","CVE-2026-78662","CVE-2026-81871","CVE-2026-81872","CVE-2026-85732"]},{"id":"RHSA-2026:68912","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","vulnerabilityIds":["CVE-2026-81871"]},{"id":"RHSA-2026:74865","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","vulnerabilityIds":["CVE-2026-81871"]},{"id":"RHSA-2026:68903","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","vulnerabilityIds":["CVE-2026-81871"]},{"id":"RHSA-2026:68715","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","vulnerabilityIds":["CVE-2026-81871","CVE-2026-81872"]},{"id":"RHSA-2026:68821","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","vulnerabilityIds":["CVE-2026-28374","CVE-2026-28376","CVE-2026-28379","CVE-2026-28380","CVE-2026-28383","CVE-2026-33376","CVE-2026-33377","CVE-2026-33378","CVE-2026-33380","CVE-2026-33381","CVE-2026-61709","CVE-2026-81871","CVE-2026-81872","CVE-2026-92599"]},{"id":"SUSE-SU-2026:23973-1","title":"Security update for helm","vulnerabilityIds":["CVE-2026-33814","CVE-2026-35204","CVE-2026-35205","CVE-2026-35206","CVE-2026-41178","CVE-2026-41888","CVE-2026-48978","CVE-2026-50151","CVE-2026-50163","CVE-2026-56852","CVE-2026-56854","CVE-2026-56855","CVE-2026-56864","CVE-2026-56865","CVE-2026-78662","CVE-2026-81871","CVE-2026-81872","CVE-2026-85732"]},{"id":"RHSA-2026:68777","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","vulnerabilityIds":["CVE-2026-61709","CVE-2026-81871"]},{"id":"SUSE-SU-2026:23990-1","title":"Security update for distribution","vulnerabilityIds":["CVE-2026-81871","CVE-2026-81872"]},{"id":"openSUSE-SU-2026:21983-1","title":"Security update for helm","vulnerabilityIds":["CVE-2026-33814","CVE-2026-35204","CVE-2026-35205","CVE-2026-35206","CVE-2026-41178","CVE-2026-41888","CVE-2026-48978","CVE-2026-50151","CVE-2026-50163","CVE-2026-56852","CVE-2026-56854","CVE-2026-56855","CVE-2026-56864","CVE-2026-56865","CVE-2026-78662","CVE-2026-81871","CVE-2026-81872","CVE-2026-85732"]},{"id":"openSUSE-SU-2026:11872-1","title":"distribution-registry-3.1.1-8.1 on GA media","vulnerabilityIds":["CVE-2026-81871","CVE-2026-81872"]},{"id":"RHSA-2026:68716","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","vulnerabilityIds":["CVE-2026-81871","CVE-2026-81872"]},{"id":"openSUSE-SU-2026:12114-1","title":"alloy-1.20.1-1.1 on GA media","vulnerabilityIds":["CVE-2026-14362","CVE-2026-63209","CVE-2026-81871","CVE-2026-81872","CVE-2026-84303","CVE-2026-84304","CVE-2026-84445"]},{"id":"RHSA-2026:74948","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","vulnerabilityIds":["CVE-2026-56851","CVE-2026-81871"]},{"id":"RHSA-2026:68778","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","vulnerabilityIds":["CVE-2026-28374","CVE-2026-28376","CVE-2026-28379","CVE-2026-28380","CVE-2026-28383","CVE-2026-33376","CVE-2026-33377","CVE-2026-33378","CVE-2026-33380","CVE-2026-33381","CVE-2026-42127","CVE-2026-81871","CVE-2026-81872","CVE-2026-92599"]},{"id":"openSUSE-SU-2026:11892-1","title":"helm3-3.22.0-2.1 on GA media","vulnerabilityIds":["CVE-2026-81871","CVE-2026-81872"]},{"id":"RHSA-2026:68905","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","vulnerabilityIds":["CVE-2026-81871","CVE-2026-81872"]},{"id":"RHSA-2026:68910","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","vulnerabilityIds":["CVE-2026-81871","CVE-2026-81872"]},{"id":"SUSE-SU-2026:24282-1","title":"Security update for helm","vulnerabilityIds":["CVE-2026-33814","CVE-2026-35204","CVE-2026-35205","CVE-2026-35206","CVE-2026-41178","CVE-2026-41888","CVE-2026-48978","CVE-2026-50151","CVE-2026-50163","CVE-2026-56852","CVE-2026-56854","CVE-2026-56855","CVE-2026-56864","CVE-2026-56865","CVE-2026-63209","CVE-2026-78662","CVE-2026-81870","CVE-2026-81871","CVE-2026-81872","CVE-2026-85732"]},{"id":"RHSA-2026:68717","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","vulnerabilityIds":["CVE-2026-56851","CVE-2026-63209","CVE-2026-81871","CVE-2026-81872","CVE-2026-93450"]},{"id":"RHSA-2026:68941","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","vulnerabilityIds":["CVE-2026-81871"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-81262","identifiers":["EUVD-2026-81262","CVE-2026-81871","GHSA-w34q-cm8f-9c5x"]},"retained":false,"historicalAffected":[]}],"coverage":[]}