Aller au contenu
en Se connecter
6.3 Moyenne

CVE-2026-81871 OpenTelemetry-Go is the Go implementation of OpenTelemetry

Description

OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.21.0, the exporters/otlp/otlplog/otlploggrpc package loads OTEL_EXPORTER_OTLP_LOGS_CERTIFICATE, OTEL_EXPORTER_OTLP_CERTIFICATE, and related client certificate environment variables through loadEnvTLS into cfg.tlsCfg, but newGRPCDialOptions does not apply cfg.tlsCfg when creating gRPC transport credentials. The environment-only TLS path instead uses credentials.NewTLS with system roots and no configured client certificate, bypassing intended private CA pinning and mutual TLS unless the application also supplies WithTLSCredentials. A network attacker able to intercept or spoof the collector connection with a system-trusted certificate can read or alter log telemetry. This issue is fixed in version 0.21.0.

Produits et versions touchés

Produit Versions touchées Corrigé en
opentelemetry-go 0.21 premières → < 0.21.0 0.21.0

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de opentelemetry-go

Les 9 CVE de opentelemetry-go →
CVE-2026-81872 OpenTelemetry-Go is the Go implementation of OpenTelemetry 6.3 Moyenne CVE-2026-81869 OpenTelemetry-Go is the Go implementation of OpenTelemetry 5.1 Moyenne CVE-2026-81870 OpenTelemetry-Go is the Go implementation of OpenTelemetry 2.0 Faible CVE-2026-45404 OpenTelemetry-Go is the Go implementation of OpenTelemetry 5.9 Moyenne
Suivre cette CVE