THREATOPS
THREAT OPSThreat News › [GHSA] GHSA-w34q-cm8f-9c5x (medium) — OpenTelemetry-Go: Log gRPC exporter ignores env TLS certs, bypassing mTLS/pinning

[GHSA] GHSA-w34q-cm8f-9c5x (medium) — OpenTelemetry-Go: Log gRPC exporter ignores env TLS certs, bypassing mTLS/pinning

highgithub_advisoriesPublished 2026-09-17

GHSA-w34q-cm8f-9c5x Severity: medium CVE: CVE-2026-81871

OpenTelemetry-Go: Log gRPC exporter ignores env TLS certs, bypassing mTLS/pinning

### Summary

The OTLP log gRPC exporter loads TLS settings from environment variables but does not apply them when creating gRPC transport credentials. Operators who rely on `OTEL_EXPORTER_OTLP_LOGS_CERTIFICATE`, `OTEL_EXPORTER_OTLP_CERTIFICATE`, or related c

MITRE ATT&CK techniques

Indicators of compromise

Original source: https://github.com/advisories/GHSA-w34q-cm8f-9c5x