CVE-2026-81871
Fixed in a distro release EPSS <1%CVSS 6.3
OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.21.0, the exporters/otlp/otlplog/otlploggrpc package loads OTEL_EXPORTER_OTLP_LOGS_CERTIFICATE, OTEL_EXPORTER_OTLP_CERTIFICATE, and related client certificate environment variables through loadEnvTLS into cfg.tlsCfg, but newGRPCDialOptions does not apply cfg.tlsCfg when creating gRPC transport credentials. The environment-only TLS path instead uses credentials.NewTLS with system roots and no configured client certificate, bypassing intended private CA pinning and mutual TLS unless the application also supplies WithTLSCredentials. A network attacker able to intercept or spoof the collector connection with a system-trusted certificate can read or alter log telemetry. This issue is fixed in version 0.21.0.
Products: open-telemetry opentelemetry-go
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc | 0.21.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | amazon-cloudwatch-agent | 1.300073.1-r2 |
| Chainguard | amazon-cloudwatch-agent-fips | 1.300073.1-r2 |
| Chainguard | aws-otel-collector | 0.50.0-r4 |
| Chainguard | aws-otel-collector-fips | 0.50.0-r5 |
| Chainguard | caddy | 2.11.4-r14 |
| Chainguard | caddy-fips | 2.11.4-r14 |
| Chainguard | commercial-grafana-11.6 | no fix |
| Chainguard | commercial-grafana-12.1 | no fix |
| Chainguard | commercial-grafana-12.2 | no fix |
| Chainguard | commercial-grafana-12.3 | no fix |
| Chainguard | commercial-grafana-12.4 | 12.4.12-r0 |
| Chainguard | commercial-grafana-13.0 | 13.0.10-r0 |
| Chainguard | commercial-grafana-13.1 | 13.1.7-r0 |
| Chainguard | commercial-grafana-13.2 | 13.2.3-r0 |
| Chainguard | dagger | no fix |
| Chainguard | datadog-agent-7.76-serverless-init | no fix |
| Chainguard | datadog-agent-7.77 | no fix |
| Chainguard | datadog-agent-7.77-full | no fix |
| Chainguard | datadog-agent-7.77-serverless-init | no fix |
| Chainguard | datadog-agent-7.78 | 7.78.4-r21 |
| Chainguard | datadog-agent-7.78-full | 7.78.4-r21 |
| Chainguard | datadog-agent-7.78-serverless-init | 7.78.4-r21 |
| Chainguard | datadog-agent-7.79 | no fix |
| Chainguard | datadog-agent-7.79-full | no fix |
| Chainguard | datadog-agent-7.79-serverless-init | no fix |
| Chainguard | datadog-agent-7.80 | 7.80.4-r18 |
| Chainguard | datadog-agent-7.80-full | 7.80.4-r19 |
| Chainguard | datadog-agent-7.80-full | 7.80.4-r18 |
| Chainguard | datadog-agent-7.80-serverless-init | 7.80.4-r18 |
| Chainguard | datadog-agent-7.81 | 7.81.3-r7 |
| Chainguard | datadog-agent-7.81-full | 7.81.3-r7 |
| Chainguard | datadog-agent-7.81-serverless-init | 7.81.3-r7 |
| Chainguard | datadog-agent-7.82 | no fix |
| Chainguard | datadog-agent-7.82-full | no fix |
| Chainguard | datadog-agent-7.82-serverless-init | no fix |
| Chainguard | datadog-agent-7.83 | 7.83.2-r3 |
| Chainguard | datadog-agent-7.83-full | 7.83.2-r3 |
| Chainguard | datadog-agent-7.83-serverless-init | 7.83.2-r3 |
| Chainguard | datadog-agent-fips-7.77 | no fix |
| Chainguard | datadog-agent-fips-7.77-full | no fix |
| Chainguard | datadog-agent-fips-7.77-serverless-init | no fix |
| Chainguard | datadog-agent-fips-7.78 | no fix |
| Chainguard | datadog-agent-fips-7.78-full | no fix |
| Chainguard | datadog-agent-fips-7.78-serverless-init | no fix |
| Chainguard | datadog-agent-fips-7.79 | 7.79.2-r17 |
| Chainguard | datadog-agent-fips-7.79-full | 7.79.2-r17 |
| Chainguard | datadog-agent-fips-7.79-serverless-init | 7.79.2-r17 |
| Chainguard | datadog-agent-fips-7.80 | 7.80.4-r20 |
| Chainguard | datadog-agent-fips-7.80-full | 7.80.4-r20 |
| Chainguard | datadog-agent-fips-7.80-serverless-init | 7.80.4-r20 |
| Chainguard | datadog-agent-fips-7.81 | 7.81.3-r11 |
| Chainguard | datadog-agent-fips-7.81-full | 7.81.3-r11 |
| Chainguard | datadog-agent-fips-7.81-serverless-init | 7.81.3-r11 |
| Chainguard | datadog-agent-fips-7.82 | 7.82.3-r7 |
| Chainguard | datadog-agent-fips-7.82-full | 7.82.3-r7 |
| Chainguard | datadog-agent-fips-7.82-serverless-init | 7.82.3-r7 |
| Chainguard | datadog-agent-fips-7.83 | 7.83.3-r1 |
| Chainguard | datadog-agent-fips-7.83-full | 7.83.3-r1 |
| Chainguard | datadog-agent-fips-7.83-serverless-init | 7.83.3-r1 |
| Chainguard | distribution | 3.1.1-r16 |
| Chainguard | distribution-fips | 3.1.1-r15 |
| Chainguard | dynatrace-operator | 1.10.2-r6 |
| Chainguard | dynatrace-operator-fips | 1.10.2-r7 |
| Chainguard | elastic-agent-8.19 | 8.19.21-r3 |
| Chainguard | elastic-agent-9.2 | 9.2.8-r24 |
| Chainguard | elastic-agent-9.3 | 9.3.8-r8 |
| Chainguard | elastic-agent-fips-8.19 | 8.19.21-r4 |
| Chainguard | elastic-agent-fips-9.2 | 9.2.8-r20 |
| Chainguard | elastic-agent-fips-9.3 | no fix |
| Chainguard | elastic-otel-collector-9.3 | 9.3.8-r8 |
| Chainguard | elastic-otel-collector-fips-9.3 | no fix |
| Chainguard | envoy-ai-gateway-extproc | 1.1.0-r4 |
| Chainguard | envoy-ai-gateway-fips-extproc | 1.1.0-r5 |
| Chainguard | falcosidekick | 2.35.0-r5 |
| Chainguard | falcosidekick-fips | 2.35.0-r5 |
| Chainguard | fluent-bit-plugin-loki | 3.7.8-r1 |
| Chainguard | frankenphp-8.2 | 1.12.7-r12 |
| Chainguard | frankenphp-8.3 | 1.12.7-r10 |
| Chainguard | frankenphp-8.4 | 1.12.7-r12 |
| Chainguard | frankenphp-8.5 | 1.12.7-r12 |
| Chainguard | google-cloud-otel-ops-collector | 0.159.0-r5 |
| Chainguard | grafana-11.6 | no fix |
| Chainguard | grafana-12.1 | no fix |
| Chainguard | grafana-12.2 | no fix |
| Chainguard | grafana-12.3 | 12.3.11-r8 |
| Chainguard | grafana-12.4 | 12.4.11-r2 |
| Chainguard | grafana-13.0 | 13.0.9-r2 |
| Chainguard | grafana-13.1 | 13.1.6-r2 |
| Chainguard | grafana-13.2 | 13.2.2-r1 |
| Chainguard | grafana-alloy | 1.19.2-r6 |
| Chainguard | grafana-alloy-fips | 1.20.0-r0 |
| Chainguard | grafana-fips-11.6 | no fix |
| Chainguard | grafana-fips-12.1 | 12.1.10.01-r16 |
| Chainguard | grafana-fips-12.2 | no fix |
| Chainguard | grafana-fips-12.3 | 12.3.11-r6 |
| Chainguard | grafana-fips-12.4 | 12.4.11-r2 |
| Chainguard | grafana-fips-13.0 | 13.0.9-r2 |
| Chainguard | grafana-fips-13.1 | 13.1.6-r2 |
| Chainguard | grafana-fips-13.2 | 13.2.2-r1 |
| Chainguard | grafana-geomys-fips-13.1 | 13.1.6-r2 |
| Chainguard | grafana-geomys-fips-13.2 | 13.2.2-r1 |
| Chainguard | grafana-mimir-2.17 | 2.17.11-r16 |
| Chainguard | grafana-mimir-2.17-metaconvert-2.17 | 2.17.11-r16 |
| Chainguard | grafana-mimir-2.17-mimirtool-2.17 | 2.17.11-r16 |
| Chainguard | grafana-mimir-2.17-query-tee-2.17 | 2.17.11-r16 |
| Chainguard | grafana-mimir-3.0 | 3.0.9-r6 |
| Chainguard | grafana-mimir-3.0-metaconvert-3.0 | 3.0.9-r6 |
| Chainguard | grafana-mimir-3.0-mimirtool-3.0 | 3.0.9-r6 |
| Chainguard | grafana-mimir-3.0-query-tee-3.0 | 3.0.9-r6 |
| Chainguard | grafana-mimir-3.1 | 3.1.6-r1 |
| Chainguard | grafana-mimir-3.1-metaconvert-3.1 | 3.1.6-r1 |
| Chainguard | grafana-mimir-3.1-mimirtool-3.1 | 3.1.6-r1 |
| Chainguard | grafana-mimir-3.1-query-tee-3.1 | 3.1.6-r1 |
| Chainguard | grafana-mimir-3.2 | 3.2.1-r1 |
| Chainguard | grafana-mimir-3.2-metaconvert-3.2 | 3.2.1-r1 |
| Chainguard | grafana-mimir-3.2-mimirtool-3.2 | 3.2.1-r1 |
| Chainguard | grafana-mimir-3.2-query-tee-3.2 | 3.2.1-r1 |
| Chainguard | grafana-mimir-fips-2.17 | 2.17.11-r16 |
| Chainguard | grafana-mimir-fips-3.0 | 3.0.9-r6 |
| Chainguard | grafana-mimir-fips-3.1 | 3.1.6-r1 |
| Chainguard | grafana-mimir-fips-3.2 | 3.2.1-r1 |
| Chainguard | grafana-pyroscope-1.15 | 1.15.3-r22 |
| Chainguard | grafana-pyroscope-1.16 | 1.16.2-r26 |
| Chainguard | grafana-pyroscope-1.17 | 1.17.4-r22 |
| Chainguard | grafana-pyroscope-1.18 | 1.18.2-r22 |
| Chainguard | grafana-pyroscope-1.19 | 1.19.3-r17 |
| Chainguard | grafana-pyroscope-1.20 | 1.20.4-r17 |
| Chainguard | grafana-pyroscope-1.21 | 1.21.1-r14 |
| Chainguard | grafana-pyroscope-2.0 | 2.0.6-r8 |
| Chainguard | grafana-pyroscope-2.1 | 2.1.2-r6 |
| Chainguard | grafana-pyroscope-2.2 | 2.2.2-r2 |
| Chainguard | grafana-pyroscope-2.3 | 2.3.1-r2 |
| Chainguard | grafana-pyroscope-fips-2.0 | 2.0.6-r6 |
| Chainguard | grafana-pyroscope-fips-2.1 | 2.1.2-r4 |
| Chainguard | grafana-pyroscope-fips-2.2 | 2.2.2-r2 |
| Chainguard | grafana-pyroscope-fips-2.3 | 2.3.1-r2 |
| Chainguard | harbor-registry | 3.1.1-r16 |
| Chainguard | harbor-registry-fips | 3.1.1-r18 |
| Chainguard | kots | 1.131.8-r2 |
| Chainguard | loki-3.6 | 3.6.17-r1 |
| Chainguard | loki-3.6-logcli | 3.6.17-r1 |
| Chainguard | loki-3.6-loki-canary | 3.6.17-r1 |
| Chainguard | loki-3.6-promtail | 3.6.17-r1 |
| Chainguard | loki-3.7 | 3.7.8-r1 |
| Chainguard | loki-3.7-logcli | 3.7.8-r1 |
| Chainguard | loki-3.7-loki-canary | 3.7.8-r1 |
| Chainguard | loki-fips-3.6 | 3.6.17-r1 |
| Chainguard | loki-fips-3.6-logcli | 3.6.17-r1 |
| Chainguard | loki-fips-3.6-loki-canary | 3.6.17-r1 |
| Chainguard | loki-fips-3.6-promtail | 3.6.17-r1 |
| Chainguard | loki-fips-3.7 | 3.7.8-r1 |
| Chainguard | loki-fips-3.7-logcli | 3.7.8-r1 |
| Chainguard | loki-fips-3.7-loki-canary | 3.7.8-r1 |
| Chainguard | mcp-grafana | 1.6.2-r0 |
| Chainguard | mcp-grafana-fips | 1.5.1-r1 |
| Chainguard | opentelemetry-go-instrumentation | 0.24.0-r4 |
| Chainguard | opentelemetry-go-instrumentation-fips | 0.24.0-r3 |
| Chainguard | opentofu-1.11 | 1.11.14-r7 |
| Chainguard | opentofu-1.12 | 1.12.6-r8 |
| Chainguard | opentofu-fips-1.11 | 1.11.14-r5 |
| Chainguard | opentofu-fips-1.12 | 1.12.6-r9 |
| Chainguard | percona-grafana | 3.9.1-r4 |
| Chainguard | pulumi-kubernetes-operator | 2.9.1-r3 |
| Chainguard | tempo-2.10 | 2.10.8-r7 |
| Chainguard | tempo-2.10-cli | 2.10.8-r7 |
| Chainguard | tempo-2.10-vulture | 2.10.8-r7 |
| Chainguard | tempo-2.8 | 2.8.4-r20 |
| Chainguard | tempo-2.8-cli | 2.8.4-r20 |
| Chainguard | tempo-2.8-vulture | 2.8.4-r20 |
| Chainguard | tempo-2.9 | 2.9.5-r7 |
| Chainguard | tempo-2.9-cli | 2.9.5-r7 |
| Chainguard | tempo-2.9-vulture | 2.9.5-r7 |
| Chainguard | tempo-3.0 | 3.0.3-r8 |
| Chainguard | tempo-3.0-cli | 3.0.3-r8 |
| Chainguard | tempo-3.0-vulture | 3.0.3-r8 |
| Chainguard | tempo-fips-2.10 | 2.10.8-r5 |
| Chainguard | tempo-fips-2.10-cli | 2.10.8-r5 |
| Chainguard | tempo-fips-2.10-vulture | 2.10.8-r5 |
| Chainguard | tempo-fips-2.8 | 2.8.4-r13 |
| Chainguard | tempo-fips-2.8-cli | 2.8.4-r13 |
| Chainguard | tempo-fips-2.8-vulture | 2.8.4-r13 |
| Chainguard | tempo-fips-2.9 | 2.9.5-r6 |
| Chainguard | tempo-fips-2.9-cli | 2.9.5-r6 |
| Chainguard | tempo-fips-2.9-vulture | 2.9.5-r6 |
| Chainguard | tempo-fips-3.0 | 3.0.3-r5 |
| Chainguard | tempo-fips-3.0-cli | 3.0.3-r5 |
| Chainguard | tempo-fips-3.0-vulture | 3.0.3-r5 |
| Chainguard | terraform-1.14 | 1.14.9-r20 |
| Chainguard | terraform-1.15 | 1.15.9-r6 |
| Chainguard | terraform-1.16 | 1.16.3-r1 |
| Chainguard | terraform-fips-1.14 | 1.14.9-r21 |
| Chainguard | terraform-fips-1.15 | 1.15.9-r7 |
| Chainguard | terraform-fips-1.16 | 1.16.3-r1 |
| Chainguard | traefik-3.6 | no fix |
| Chainguard | traefik-3.7 | 3.7.14-r0 |
| Chainguard | traefik-fips-3.6 | no fix |
| Chainguard | traefik-fips-3.7 | 3.7.14-r0 |
| Chainguard | zitadel-4 | 4.19.1-r1 |
| Chainguard | zot | 2.1.21-r3 |
| Debian 13 | golang-opentelemetry-otel | no fix |
| Debian 14 | golang-opentelemetry-otel | no fix |
| Red Hat hummingbird 1 | caddy | 0:2.11.4-0.4.hum1 |
| Red Hat hummingbird 1 | caddy | 0:2.11.6-0.1.hum1 |
| Red Hat hummingbird 1 | distribution | 0:3.1.1-0.2.hum1 |
| Red Hat hummingbird 1 | grafana12.4 | 0:12.4.10-0.6.hum1 |
| Red Hat hummingbird 1 | grafana12.4 | 0:12.4.10-0.5.hum1 |
| Red Hat hummingbird 1 | grafana13.1 | 0:13.1.6-0.2.hum1 |
| Red Hat hummingbird 1 | grafana13.2 | 0:13.2.1-0.5.hum1 |
| Red Hat hummingbird 1 | helm3 | 0:3.22.0-0.2.hum1 |
| Red Hat hummingbird 1 | helm4 | 0:4.3.0-0.2.hum1 |
| Red Hat hummingbird 1 | jaeger | 0:2.20.0-0.9.hum1 |
| Red Hat hummingbird 1 | loki3.6 | 0:3.6.17-0.2.hum1 |
| Red Hat hummingbird 1 | loki3.6-canary | 0:3.6.17-0.2.hum1 |
| Red Hat hummingbird 1 | loki3.6-logcli | 0:3.6.17-0.2.hum1 |
| Red Hat hummingbird 1 | loki3.7 | 0:3.7.8-0.2.hum1 |
| Red Hat hummingbird 1 | loki3.7-canary | 0:3.7.8-0.2.hum1 |
| Red Hat hummingbird 1 | loki3.7-logcli | 0:3.7.8-0.2.hum1 |
| Red Hat hummingbird 1 | opentofu1.12 | 0:1.12.6-0.3.hum1 |
| Red Hat hummingbird 1 | opentofu1.12 | 0:1.12.7-0.1.hum1 |
| Red Hat hummingbird 1 | tempo2.10 | 0:2.10.8-0.3.hum1 |
| Red Hat hummingbird 1 | tempo3.0 | 0:3.0.3-0.3.hum1 |
| SUSE Linux Enterprise Server 16.0 | distribution | 3.1.1-160000.4.1 |
| SUSE Linux Enterprise Server 16.0 | helm | 4.3.0-160000.1.1 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | distribution | 3.1.1-160000.4.1 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | helm | 4.3.0-160000.1.1 |
| SUSE Linux Micro 6.2 | helm | 4.3.0-160000.1.1 |
| Ubuntu 22.04 LTS | golang-opentelemetry-otel | no fix |
| Ubuntu 24.04 LTS | golang-opentelemetry-otel | no fix |
| Ubuntu 26.04 LTS | golang-opentelemetry-otel | no fix |
| Ubuntu 26.10 | golang-opentelemetry-otel | no fix |
| Wolfi | amazon-cloudwatch-agent | 1.300073.1-r2 |
| Wolfi | aws-otel-collector | 0.50.0-r4 |
| Wolfi | caddy | 2.11.4-r14 |
| Wolfi | dagger | no fix |
| Wolfi | datadog-agent-7.77 | no fix |
| Wolfi | datadog-agent-7.77-full | no fix |
| Wolfi | datadog-agent-7.78 | 7.78.4-r21 |
| Wolfi | datadog-agent-7.78-full | 7.78.4-r21 |
| Wolfi | datadog-agent-7.79 | no fix |
| Wolfi | datadog-agent-7.79-full | no fix |
| Wolfi | datadog-agent-7.80 | 7.80.4-r18 |
| Wolfi | datadog-agent-7.80-full | 7.80.4-r19 |
| Wolfi | datadog-agent-7.80-full | 7.80.4-r18 |
| Wolfi | datadog-agent-7.81 | 7.81.3-r7 |
| Wolfi | datadog-agent-7.81-full | 7.81.3-r7 |
| Wolfi | distribution | 3.1.1-r16 |
| Wolfi | falcosidekick | 2.35.0-r5 |
| Wolfi | fluent-bit-plugin-loki | 3.7.8-r1 |
| Wolfi | grafana-12.3 | 12.3.11-r8 |
| Wolfi | grafana-12.4 | 12.4.11-r2 |
| Wolfi | grafana-13.0 | 13.0.9-r2 |
| Wolfi | grafana-alloy | 1.19.2-r6 |
| Wolfi | grafana-mimir-3.0 | 3.0.9-r6 |
| Wolfi | grafana-mimir-3.0-metaconvert-3.0 | 3.0.9-r6 |
| Wolfi | grafana-mimir-3.0-mimirtool-3.0 | 3.0.9-r6 |
| Wolfi | grafana-mimir-3.0-query-tee-3.0 | 3.0.9-r6 |
| Wolfi | grafana-mimir-3.1 | 3.1.6-r1 |
| Wolfi | grafana-mimir-3.1-metaconvert-3.1 | 3.1.6-r1 |
| Wolfi | grafana-mimir-3.1-mimirtool-3.1 | 3.1.6-r1 |
| Wolfi | grafana-mimir-3.1-query-tee-3.1 | 3.1.6-r1 |
| Wolfi | grafana-pyroscope-1.19 | 1.19.3-r17 |
| Wolfi | grafana-pyroscope-2.0 | 2.0.6-r8 |
| Wolfi | harbor-registry | 3.1.1-r16 |
| Wolfi | kots | 1.131.8-r2 |
| Wolfi | loki-3.6 | 3.6.17-r1 |
| Wolfi | loki-3.6-logcli | 3.6.17-r1 |
| Wolfi | loki-3.6-loki-canary | 3.6.17-r1 |
| Wolfi | loki-3.6-promtail | 3.6.17-r1 |
| Wolfi | loki-3.7 | 3.7.8-r1 |
| Wolfi | loki-3.7-logcli | 3.7.8-r1 |
| Wolfi | loki-3.7-loki-canary | 3.7.8-r1 |
| Wolfi | mcp-grafana | 1.6.2-r0 |
| Wolfi | opentofu-1.11 | 1.11.14-r7 |
| Wolfi | opentofu-1.12 | 1.12.6-r8 |
| Wolfi | pulumi-kubernetes-operator | 2.9.1-r3 |
| Wolfi | tempo-2.10 | 2.10.8-r7 |
| Wolfi | tempo-2.10-cli | 2.10.8-r7 |
| Wolfi | tempo-2.10-vulture | 2.10.8-r7 |
| Wolfi | tempo-3.0 | 3.0.3-r8 |
| Wolfi | tempo-3.0-cli | 3.0.3-r8 |
| Wolfi | tempo-3.0-vulture | 3.0.3-r8 |
| Wolfi | traefik-3.6 | no fix |
| Wolfi | traefik-3.7 | 3.7.14-r0 |
| Wolfi | zot | 2.1.21-r3 |
| openSUSE Leap 16.0 | distribution | 3.1.1-160000.4.1 |
| openSUSE Leap 16.0 | helm | 4.3.0-160000.1.1 |
| openSUSE Tumbleweed | alloy | 1.20.1-1.1 |
| openSUSE Tumbleweed | distribution | 3.1.1-8.1 |
| openSUSE Tumbleweed | helm | 4.3.0-3.1 |
| openSUSE Tumbleweed | helm3 | 3.22.0-2.1 |