Executive brief
OpenTelemetry-Go's OTLP log gRPC exporter ignores TLS certificate configuration from environment variables, causing it to bypass CA pinning and mTLS authentication. Operators who configure private certificate authorities or client certificates via environment variables for secure telemetry collection will find their intended security policies ineffective. An attacker positioned on the network could intercept, read, or modify log data using a system-trusted certificate, undermining organizations' logging and compliance infrastructure.
Technical details
The vulnerability is improper TLS certificate validation caused by a code path mismatch in the OTLP log gRPC exporter. The `newConfig` function correctly parses TLS settings (CA certificate, client certificate/key) from environment variables (`OTEL_EXPORTER_OTLP_LOGS_CERTIFICATE`, `OTEL_EXPORTER_OTLP_LOGS_CLIENT_CERTIFICATE`, etc.) into a `cfg.tlsCfg` object, but the `newGRPCDialOptions` function ignores this configuration. When neither explicit gRPC credentials nor the `insecure` flag is set (the normal environment-only configuration path), the code defaults to `credentials.NewTLS(nil)`, which trusts only system root CAs and omits any client certificate. Network attackers can exploit this by presenting a system-trusted certificate for the collector endpoint. The fix requires modifying `newGRPCDialOptions` to apply the loaded `cfg.tlsCfg` when creating gRPC credentials.
Affected products
- OpenTelemetry OpenTelemetry-Go since commit d99c76f
Timeline
- 2026-09-17: disclosed: Vulnerability publicly disclosed