Skip to content
Heist/ feed
UnratedFix available

OpenTelemetry-Go: Log gRPC exporter ignores env TLS certs, bypassing mTLS/pinning

Type: advisorySource: OSV1 source record

### Summary The OTLP log gRPC exporter loads TLS settings from environment variables but does not apply them when creating gRPC transport credentials. Operators who rely on `OTEL_EXPORTER_OTLP_LOGS_CERTIFICATE`, `OTEL_EXPORTER_OTLP_CERTIFICATE`, or related client certificate variables for CA pinning or mTLS get a connection that falls back to system roots and omits the env-supplied client certificate. A network attacker who can intercept or spoof the collector connection with a system-trusted certificate can read or alter log telemetry. Introduced in commit: d99c76f ### Details The affected code is in `exporters/otlp/otlplog/otlploggrpc`. `newConfig` resolves env-based TLS configuration into `cfg.tlsCfg` at `exporters/otlp/otlplog/otlploggrpc/config.go:106-116`. The finding also identifies `loadEnvTLS` at `config.go:451-492` as the code that builds a `*tls.Config` containing `RootCAs` and client certificates from `OTEL_EXPORTER_OTLP[_LOGS]_CERTIFICATE` and `OTEL_EXPORTER_OTLP[_LOGS]_CLIENT_CERTIFICATE`/`KEY`. However, `newGRPCDialOptions` in `exporters/otlp/otlplog/otlploggrpc/client.go:83-92` only checks `cfg.gRPCCredentials` and `cfg.insecure`. When neither is set, which is the normal env-only TLS configuration path, it uses `credentials.NewTLS(nil)`. That default trusts the host system root CAs and contains no env-supplied client certificate. The finding evidence reports no other `tlsCfg` use in the package, so env-based CA pinning and mTLS settings are loaded but not enfo

Announced Source revision 1
Original source ↗

GHSA-w34q-cm8f-9c5x

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:GHSA-w34q-cm8f-9c5x

go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc

Source reference: /affected/0/package/name

Affected versions
Not stated in this record
Fixed versions
0.21.0

Source reference: /affected/0/ranges

Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "SEMVER",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "0.21.0"
          }
        ]
      }
    ],
    "package": {
      "name": "go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc",
      "purl": "pkg:golang/go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc",
      "ecosystem": "Go"
    },
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-w34q-cm8f-9c5x/GHSA-w34q-cm8f-9c5x.json"
    }
  }
]
Related CVEs
CVE-2026-81871

Source reference: /aliases

Publisher severity

No explicit severity was provided.

Event
#23394 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement