Description
OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.21.0, the exporters/otlp/otlplog/otlploggrpc package loads OTEL_EXPORTER_OTLP_LOGS_CERTIFICATE, OTEL_EXPORTER_OTLP_CERTIFICATE, and related client certificate environment variables through loadEnvTLS into cfg.tlsCfg, but newGRPCDialOptions does not apply cfg.tlsCfg when creating gRPC transport credentials. The environment-only TLS path instead uses credentials.NewTLS with system roots and no configured client certificate, bypassing intended private CA pinning and mutual TLS unless the application also supplies WithTLSCredentials. A network attacker able to intercept or spoof the collector connection with a system-trusted certificate can read or alter log telemetry. This issue is fixed in version 0.21.0.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| open-telemetry | opentelemetry-go | < 0.21.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | golang-opentelemetry-otel | No fix yet | — |
| Debian 13 | golang-opentelemetry-otel | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | golang-opentelemetry-otel | No fix yet | — |
| Ubuntu 26.04 LTS | golang-opentelemetry-otel | No fix yet | — |
| Ubuntu 24.04 LTS | golang-opentelemetry-otel | No fix yet | — |
| Ubuntu 22.04 LTS | golang-opentelemetry-otel | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | caddy | 2.11.4-0.4.hum1 | RHSA-2026:74865, RHSA-2026:68715 |
| Red Hat Hardened Images 1 | distribution | 3.1.1-0.2.hum1 | RHSA-2026:68716 |
| Red Hat Hardened Images 1 | grafana12.4 | 12.4.10-0.5.hum1 | RHSA-2026:68821, RHSA-2026:68777 |
| Red Hat Hardened Images 1 | grafana13.1 | 13.1.6-0.2.hum1 | RHSA-2026:68926 |
| Red Hat Hardened Images 1 | grafana13.2 | 13.2.1-0.5.hum1 | RHSA-2026:68778 |
| Red Hat Hardened Images 1 | helm3 | 3.22.0-0.2.hum1 | RHSA-2026:68717 |
| Red Hat Hardened Images 1 | helm4 | 4.3.0-0.2.hum1 | RHSA-2026:68729 |
| Red Hat Hardened Images 1 | jaeger | 2.20.0-0.9.hum1 | RHSA-2026:68910 |
| Red Hat Hardened Images 1 | loki3.6 +2 | 3.6.17-0.2.hum1 | RHSA-2026:68932 |
| Red Hat Hardened Images 1 | loki3.7 +2 | 3.7.8-0.2.hum1 | RHSA-2026:68941 |
| Red Hat Hardened Images 1 | opentofu1.12 | 1.12.6-0.3.hum1 | RHSA-2026:74948, RHSA-2026:68905 |
| Red Hat Hardened Images 1 | tempo2.10 | 2.10.8-0.3.hum1 | RHSA-2026:68903 |
| Red Hat Hardened Images 1 | tempo3.0 | 3.0.3-0.3.hum1 | RHSA-2026:68912 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | alloy | 1.20.1-150700.15.34.1 | SUSE-SU-2026:5203-1 |
| SLES 15 SP7 | distribution | 3.1.2-150400.9.47.1 | SUSE-SU-2026:5202-1 |
| SLES 15 SP7 | helm | 3.22.1-150000.1.104.1 | SUSE-SU-2026:5119-1 |
| SLES 15 SP6 | distribution | 3.1.2-150400.9.47.1 | SUSE-SU-2026:5202-1 |
| SLES 15 SP6 | helm | 3.22.1-150000.1.104.1 | SUSE-SU-2026:5119-1 |
| SLES 15 SP5 | distribution | 3.1.2-150400.9.47.1 | SUSE-SU-2026:5202-1 |
| SLES 15 SP5 | helm | 3.22.1-150000.1.104.1 | SUSE-SU-2026:5119-1 |
| SLES 15 SP4 | distribution | 3.1.2-150400.9.47.1 | SUSE-SU-2026:5202-1 |
| SLES 15 SP4 | helm | 3.22.1-150000.1.104.1 | SUSE-SU-2026:5119-1 |
Show 10 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | distribution | 3.1.1-160000.4.1 | SUSE-SU-2026:23990-1 |
| SLES for SAP 16.0 | helm | 4.3.0-160000.1.1 | SUSE-SU-2026:23984-1 |
| SLES for SAP 15 SP6 | distribution | 3.1.2-150400.9.47.1 | SUSE-SU-2026:5202-1 |
| SLES for SAP 15 SP6 | helm | 3.22.1-150000.1.104.1 | SUSE-SU-2026:5119-1 |
| SLES for SAP 15 SP5 | distribution | 3.1.2-150400.9.47.1 | SUSE-SU-2026:5202-1 |
| SLES for SAP 15 SP5 | helm | 3.22.1-150000.1.104.1 | SUSE-SU-2026:5119-1 |
| SLES for SAP 15 SP4 | distribution | 3.1.2-150400.9.47.1 | SUSE-SU-2026:5202-1 |
| SLES for SAP 15 SP4 | helm | 3.22.1-150000.1.104.1 | SUSE-SU-2026:5119-1 |
| SLES 16.0 | distribution | 3.1.1-160000.4.1 | SUSE-SU-2026:23990-1 |
| SLES 16.0 | helm | 4.3.0-160000.1.1 | SUSE-SU-2026:23984-1 |
| SLE Micro 6.2 | helm | 4.3.0-160000.1.1 | SUSE-SU-2026:23973-1 |
| SLE Micro 6.1 | helm | 4.3.0-slfo.1.1_1.1 | SUSE-SU-2026:24282-1 |
| SLE Micro 5.5 | helm | 3.22.1-150000.1.104.1 | SUSE-SU-2026:5119-1 |
| SLE HPC 15 SP5 | distribution | 3.1.2-150400.9.47.1 | SUSE-SU-2026:5202-1 |
| SLE HPC 15 SP5 | helm | 3.22.1-150000.1.104.1 | SUSE-SU-2026:5119-1 |
| SLE HPC 15 SP4 | distribution | 3.1.2-150400.9.47.1 | SUSE-SU-2026:5202-1 |
| SLE HPC 15 SP4 | helm | 3.22.1-150000.1.104.1 | SUSE-SU-2026:5119-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | alloy | 1.20.1-1.1 | openSUSE-SU-2026:12114-1 |
| openSUSE Tumbleweed | distribution | 3.1.1-8.1 | openSUSE-SU-2026:11872-1 |
| openSUSE Tumbleweed | helm | 4.3.0-3.1 | openSUSE-SU-2026:11875-1 |
| openSUSE Tumbleweed | helm3 | 3.22.0-2.1 | openSUSE-SU-2026:11892-1 |
| openSUSE Leap 16.0 | distribution | 3.1.1-160000.4.1 | openSUSE-SU-2026:22010-1 |
| openSUSE Leap 16.0 | helm | 4.3.0-160000.1.1 | openSUSE-SU-2026:21983-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | azl-otel-collector | No fix yet | — |
| Azure Linux 3 | azurelinux-image-tools | 1.7.0-2 | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | amazon-cloudwatch-agent | 1.300073.1-r2 | — |
| Wolfi rolling | aws-otel-collector | 0.50.0-r4 | — |
| Wolfi rolling | caddy | 2.11.4-r14 | — |
| Wolfi rolling | dagger +5 | No fix yet | — |
| Wolfi rolling | datadog-agent-7.78 +1 | 7.78.4-r21 | — |
| Wolfi rolling | datadog-agent-7.80 +1 | 7.80.4-r18 | — |
| Wolfi rolling | datadog-agent-7.81 +1 | 7.81.3-r7 | — |
| Wolfi rolling | distribution +1 | 3.1.1-r16 | — |
| Wolfi rolling | falcosidekick | 2.35.0-r5 | — |
| Wolfi rolling | grafana-12.3 | 12.3.11-r8 | — |
| Wolfi rolling | grafana-12.4 | 12.4.11-r2 | — |
| Wolfi rolling | grafana-13.0 | 13.0.9-r2 | — |
| Wolfi rolling | grafana-alloy | 1.19.2-r6 | — |
| Wolfi rolling | grafana-mimir-3.0 +3 | 3.0.9-r6 | — |
| Wolfi rolling | grafana-mimir-3.1 +3 | 3.1.6-r1 | — |
| Wolfi rolling | grafana-pyroscope-1.19 | 1.19.3-r17 | — |
| Wolfi rolling | grafana-pyroscope-2.0 | 2.0.6-r8 | — |
| Wolfi rolling | kots | 1.131.8-r2 | — |
| Wolfi rolling | loki-3.6 +3 | 3.6.17-r1 | — |
| Wolfi rolling | loki-3.7 +3 | 3.7.8-r1 | — |
| Wolfi rolling | mcp-grafana | 1.6.2-r0 | — |
| Wolfi rolling | opentofu-1.11 | 1.11.14-r7 | — |
| Wolfi rolling | opentofu-1.12 | 1.12.6-r8 | — |
| Wolfi rolling | pulumi-kubernetes-operator | 2.9.1-r3 | — |
| Wolfi rolling | tempo-2.10 +2 | 2.10.8-r7 | — |
| Wolfi rolling | tempo-3.0 +2 | 3.0.3-r8 | — |
| Wolfi rolling | traefik-3.7 | 3.7.14-r0 | — |
| Wolfi rolling | zot | 2.1.21-r3 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc | < 0.21.0 | 0.21.0 | GHSA-w34q-cm8f-9c5x |
Advisories 29
- SUSE-SU-2026:5203-1 Security update for alloy SUSE / openSUSE Security Updates · Nov 12, 2026
- SUSE-SU-2026:5202-1 Security update for distribution SUSE / openSUSE Security Updates · Nov 12, 2026
- SUSE-SU-2026:5119-1 Security update for helm SUSE / openSUSE Security Updates · Nov 5, 2026
- SUSE-SU-2026:24282-1 Security update for helm SUSE / openSUSE Security Updates · Oct 27, 2026
- RHSA-2026:68717 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:74948 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:68729 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:68821 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:68777 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:68778 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2026:74865 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:68941 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:68932 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:68912 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:68926 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:68905 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:68910 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:68903 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:68716 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:68715 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- openSUSE-SU-2026:12114-1 alloy-1.20.1-1.1 on GA media SUSE / openSUSE Security Updates · Oct 14, 2026
- SUSE-SU-2026:23984-1 Security update for helm SUSE / openSUSE Security Updates · Oct 6, 2026
- SUSE-SU-2026:23990-1 Security update for distribution SUSE / openSUSE Security Updates · Oct 6, 2026
- SUSE-SU-2026:23973-1 Security update for helm SUSE / openSUSE Security Updates · Oct 6, 2026
- openSUSE-SU-2026:22010-1 Security update for distribution SUSE / openSUSE Security Updates · Oct 3, 2026
- openSUSE-SU-2026:21983-1 Security update for helm SUSE / openSUSE Security Updates · Oct 1, 2026
- openSUSE-SU-2026:11892-1 helm3-3.22.0-2.1 on GA media SUSE / openSUSE Security Updates · Sep 29, 2026
- openSUSE-SU-2026:11872-1 distribution-registry-3.1.1-8.1 on GA media SUSE / openSUSE Security Updates · Sep 25, 2026
- openSUSE-SU-2026:11875-1 helm-4.3.0-3.1 on GA media SUSE / openSUSE Security Updates · Sep 25, 2026