THREAT OPS › Threat News › [GHSA] GHSA-w34q-cm8f-9c5x (medium) — OpenTelemetry-Go: Log gRPC exporter ignores env TLS certs, bypassing mTLS/pinning
[GHSA] GHSA-w34q-cm8f-9c5x (medium) — OpenTelemetry-Go: Log gRPC exporter ignores env TLS certs, bypassing mTLS/pinning
GHSA-w34q-cm8f-9c5x Severity: medium CVE: CVE-2026-81871
OpenTelemetry-Go: Log gRPC exporter ignores env TLS certs, bypassing mTLS/pinning
### Summary
The OTLP log gRPC exporter loads TLS settings from environment variables but does not apply them when creating gRPC transport credentials. Operators who rely on `OTEL_EXPORTER_OTLP_LOGS_CERTIFICATE`, `OTEL_EXPORTER_OTLP_CERTIFICATE`, or related c
MITRE ATT&CK techniques
- CredentialsT1589.001
Indicators of compromise
- e6e2897a969c8191b260f243fbc99ebdmd5
- CVE-2026-81871cve
- https://127.0.0.1:url
Original source: https://github.com/advisories/GHSA-w34q-cm8f-9c5x