go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc: OpenTelemetry-Go: TLS certificate bypass allows log telemetry interception and alteration

A flaw was found in OpenTelemetry-Go, specifically within its gRPC log exporter. This vulnerability allows a network attacker to bypass the intended private Certificate Authority CA pinning and mutual Transport Layer Security TLS configurations. The issue arises because the environment-only TLS...

CLEANSTART-2026-ER31598 OpenTelemetry-Go is the Go implementation of OpenTelemetry

Security vulnerability affects the cosign package. OpenTelemetry-Go is the Go implementation of OpenTelemetry...

CVE-2026-81870

A flaw was found in OpenTelemetry-Go. The sdk/trace.NewTracerProvider component emits an internal Info-level diagnostic event that recursively includes span processor, exporter, and client configuration. If an application enables OpenTelemetry internal Info logging, a person or system with access...

CVE-2026-81869

A flaw was found in OpenTelemetry-Go. An attacker who can control span attribute content can bypass the attribute length truncation mechanism. This occurs when string attributes contain the Unicode replacement character U+FFFD, preventing the enforcement of configured memory limits. This...

go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc: OpenTelemetry-Go: TLS certificate bypass allows log telemetry interception and alteration

A flaw was found in OpenTelemetry-Go, specifically within its gRPC log exporter. This vulnerability allows a network attacker to bypass the intended private Certificate Authority CA pinning and mutual Transport Layer Security TLS configurations. The issue arises because the environment-only TLS...

go.opentelemetry.io/otel/sdk/log: OpenTelemetry-Go: Denial of Service via attacker-driven log emission

A flaw was found in the OpenTelemetry-Go BatchingProcessor component. A remote attacker can exploit this by sending a high volume of log emissions, which can fill the asynchronous export buffer. This causes the processor to enter a tight CPU loop, repeatedly retrying to export logs without proper...

CVE-2026-81872

A flaw was found in the OpenTelemetry-Go BatchingProcessor component. A remote attacker can exploit this by sending a high volume of log emissions, which can fill the asynchronous export buffer. This causes the processor to enter a tight CPU loop, repeatedly retrying to export logs without proper...

CVE-2026-81871

A flaw was found in OpenTelemetry-Go, specifically within its gRPC log exporter. This vulnerability allows a network attacker to bypass the intended private Certificate Authority CA pinning and mutual Transport Layer Security TLS configurations. The issue arises because the environment-only TLS...

Linux Distros Unpatched Vulnerability : CVE-2026-81869

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.10.0 until 1.33.0, the sdk/trace/span.go attribute truncation path can fail to enforc...

Linux Distros Unpatched Vulnerability : CVE-2026-81870

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.5.0 to 1.44.0, sdk/trace.NewTracerProvider emits a TracerProvider created internal...

Linux Distros Unpatched Vulnerability : CVE-2026-81872

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.21.0, the go.opentelemetry.io/otel/sdk/log BatchingProcessor can enter a tight CP...

Linux Distros Unpatched Vulnerability : CVE-2026-81871

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.21.0, the exporters/otlp/otlplog/otlploggrpc package loads...

CVE-2026-81870

creationtimestamp| type| source ---|---|--- 2026-09-17 22:35:24+00:00| published-proof-of-concept| https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-8wmf-6v46-5gfg 2026-09-25 05:40:14+00:00| seen| https://bsky.app/profile/gcpweekly.bsky.social/post/3mwd2n5ayqy2l 2026-09-...

CVE-2026-81871

creationtimestamp| type| source ---|---|--- 2026-09-17 22:35:22+00:00| published-proof-of-concept| https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-w34q-cm8f-9c5x 2026-09-25 05:40:14+00:00| seen| https://bsky.app/profile/gcpweekly.bsky.social/post/3mwd2n5ayqy2l 2026-10-...

go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc: OpenTelemetry-Go: TLS certificate bypass allows log telemetry interception and alteration

A flaw was found in OpenTelemetry-Go, specifically within its gRPC log exporter. This vulnerability allows a network attacker to bypass the intended private Certificate Authority CA pinning and mutual Transport Layer Security TLS configurations. The issue arises because the environment-only TLS...

go.opentelemetry.io/otel/sdk/log: OpenTelemetry-Go: Denial of Service via attacker-driven log emission

A flaw was found in the OpenTelemetry-Go BatchingProcessor component. A remote attacker can exploit this by sending a high volume of log emissions, which can fill the asynchronous export buffer. This causes the processor to enter a tight CPU loop, repeatedly retrying to export logs without proper...

go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc: OpenTelemetry-Go: TLS certificate bypass allows log telemetry interception and alteration

A flaw was found in OpenTelemetry-Go, specifically within its gRPC log exporter. This vulnerability allows a network attacker to bypass the intended private Certificate Authority CA pinning and mutual Transport Layer Security TLS configurations. The issue arises because the environment-only TLS...

GHSA-W34Q-CM8F-9C5X OpenTelemetry-Go: Log gRPC exporter ignores env TLS certs, bypassing mTLS/pinning

Summary The OTLP log gRPC exporter loads TLS settings from environment variables but does not apply them when creating gRPC transport credentials. Operators who rely on OTELEXPORTEROTLPLOGSCERTIFICATE, OTELEXPORTEROTLPCERTIFICATE, or related client certificate variables for CA pinning or mTLS get...

EUVD-2026-81262

OpenTelemetry-Go: Log gRPC exporter ignores env TLS certs, bypassing mTLS/pinning...

OpenTelemetry-Go: Log gRPC exporter ignores env TLS certs, bypassing mTLS/pinning

Summary The OTLP log gRPC exporter loads TLS settings from environment variables but does not apply them when creating gRPC transport credentials. Operators who rely on OTELEXPORTEROTLPLOGSCERTIFICATE, OTELEXPORTEROTLPCERTIFICATE, or related client certificate variables for CA pinning or mTLS get...