Is CVE-2026-81871 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-81871 being exploited in the wild.

How severe is CVE-2026-81871?

Medium severity, with a CVSS score of 4, published 16 September 2026.

Which products and versions are affected?

go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc (Go) < 0.21.0, SEMVER:introduced=0,fixed=0.21.0; Opentelemetry-Go since commit d99c76f.

Is there a fix for CVE-2026-81871?

Yes. go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc (Go): upgrade to 0.21.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-81871 attacked?

It is attacked over the network.

Am I affected by CVE-2026-81871?

Check whether you run go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc (Go) or Opentelemetry-Go at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-81871: OpenTelemetry-Go OTLP log gRPC exporter TLS certificate validation bypass

Q: Is there a fix for CVE-2026-81871?

Yes. go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc (Go): upgrade to 0.21.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-81871 attacked?

It is attacked over the network.

Q: Am I affected by CVE-2026-81871?

Check whether you run go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc (Go) or Opentelemetry-Go at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-81871 · Severity: medium · CVSS 4 · Published 2026-09-16

OpenTelemetry-Go's OTLP log gRPC exporter ignores TLS certificate configuration from environment variables, causing it to bypass CA pinning and mTLS authentication. Operators who configure private certificate authorities or client certificates via environment variables for secure telemetry collection will find their intended security policies ineffective. An attacker positioned on the network could intercept, read, or modify log data using a system-trusted certificate, undermining organizations' logging and compliance infrastructure.

Technologies: Opentelemetry-Go. Vendors: Go, Opentelemetry.

Quick answers

Is CVE-2026-81871 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-81871 being exploited in the wild.
How severe is CVE-2026-81871?: Medium severity, with a CVSS score of 4, published 16 September 2026.
Which products and versions are affected?: go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc (Go) < 0.21.0, SEMVER:introduced=0,fixed=0.21.0; Opentelemetry-Go since commit d99c76f.
Is there a fix for CVE-2026-81871?: Yes. go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc (Go): upgrade to 0.21.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-81871 attacked?: It is attacked over the network.
Am I affected by CVE-2026-81871?: Check whether you run go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc (Go) or Opentelemetry-Go at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc (Go): upgrade to 0.21.0 or later
```
go get go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc@v0.21.0
```

Technical details

The vulnerability is improper TLS certificate validation caused by a code path mismatch in the OTLP log gRPC exporter. The `newConfig` function correctly parses TLS settings (CA certificate, client certificate/key) from environment variables (`OTEL_EXPORTER_OTLP_LOGS_CERTIFICATE`, `OTEL_EXPORTER_OTLP_LOGS_CLIENT_CERTIFICATE`, etc.) into a `cfg.tlsCfg` object, but the `newGRPCDialOptions` function ignores this configuration. When neither explicit gRPC credentials nor the `insecure` flag is set (the normal environment-only configuration path), the code defaults to `credentials.NewTLS(nil)`, which trusts only system root CAs and omits any client certificate. Network attackers can exploit this by presenting a system-trusted certificate for the collector endpoint. The fix requires modifying `newGRPCDialOptions` to apply the loaded `cfg.tlsCfg` when creating gRPC credentials.

Affected products

OpenTelemetry OpenTelemetry-Go since commit d99c76f

Identifiers

CVE-2026-81871
GHSA-w34q-cm8f-9c5x
GO-2026-6508

Timeline

2026-09-17: disclosed: Vulnerability publicly disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.