Listen to this Post
The OTLP log gRPC exporter loads TLS settings from environment variables but fails to apply them when creating gRPC transport credentials. The vulnerability exists in the `exporters/otlp/otlplog/otlploggrpc` package where the configuration resolution and credential creation are disconnected. The `newConfig` function correctly resolves environment-based TLS configuration into `cfg.tlsCfg` at config.go:106-116, and the `loadEnvTLS` function at `config.go:451-492` properly builds a `tls.Config` containing `RootCAs` and client certificates from `OTEL_EXPORTER_OTLP
_CERTIFICATE` and <code>OTEL_EXPORTER_OTLP[bash]_CLIENT_CERTIFICATE/KEY</code>. However, the `newGRPCDialOptions` function in `client.go:83-92` only checks `cfg.gRPCCredentials` and <code>cfg.insecure</code>. When neither is set, which represents the normal environment-only TLS configuration path, the code uses <code>credentials.NewTLS(nil)</code>. This default trusts the host system root CAs and contains no environment-supplied client certificate. The finding evidence reports no other `tlsCfg` use in the package, meaning environment-based CA pinning and mTLS settings are loaded but never enforced. Operators who rely on certificate variables for CA pinning or mTLS get a connection that falls back to system roots and omits the environment-supplied client certificate. A network attacker who can intercept or spoof the collector connection with a system-trusted certificate can read or alter log telemetry. This vulnerability was introduced in commit `d99c76f` and affects users who configure TLS, CA pinning, or mTLS through environment variables without also supplying explicit <code>WithTLSCredentials</code>. The validation artifact demonstrates that the environment CA is parsed into `cfg.tlsCfg` but ignored by the default gRPC dial path, resulting in an `x509: certificate signed by unknown authority` error for the first export call. This is improper TLS certificate validation and endpoint authentication caused by ignoring configured trust material. <h2 style="color: blue;">DailyCVE Form:</h2> Platform: OpenTelemetry Go Version: d99c76f Vulnerability : Improper TLS Validation Severity: High date: 2026-02-14 <h2 style="color: blue;">Prediction: 2026-03-14</h2> <h2 style="color: blue;">What Undercode Say:</h2> [bash] FINDING_DIR=/path/to/02-e6e2897a969c8191b260f243fbc99ebd-log-grpc-exporter-ignores-env-tls-certs-bypassing-mtls-pinning cd /path/to/opentelemetry-go git checkout d99c76f tar -xOf validation-artifact.tar ./poc_env_tls_ignored_test.go > exporters/otlp/otlplog/otlploggrpc/poc_env_tls_ignored_test.go cd exporters/otlp/otlplog/otlploggrpc GO111MODULE=on go test -v -run TestEnvTLSIgnored -count=1
// config.go:451-492
func loadEnvTLS(cfg Config) (tls.Config, error) {
tlsCfg := &tls.Config{}
// Load RootCAs from OTEL_EXPORTER_OTLP[bash]_CERTIFICATE
// Load client certificates from OTEL_EXPORTER_OTLP[bash]_CLIENT_CERTIFICATE/KEY
return tlsCfg, nil
}
// client.go:83-92
func newGRPCDialOptions(cfg Config) []grpc.DialOption {
if cfg.gRPCCredentials != nil {
return []grpc.DialOption{grpc.WithTransportCredentials(cfg.gRPCCredentials)}
}
if cfg.insecure {
return []grpc.DialOption{grpc.WithTransportCredentials(insecure.NewCredentials())}
}
return []grpc.DialOption{grpc.WithTransportCredentials(credentials.NewTLS(nil))}
}
Exploit: (Educational Purposes!)
A network attacker positioned between the application and the OTLP collector can present a certificate signed by a system-trusted CA for the collector endpoint. Because the exporter ignores the environment-configured CA pinning, the gRPC connection accepts the attacker’s certificate. The attacker can then intercept, read, or modify log telemetry that operators expected to be protected by their configured CA or mTLS policy. The client certificate from environment variables is also omitted, so mutual TLS authentication fails silently while the connection still succeeds with system roots.
Protection: from this CVE
Upgrade to a patched version of `go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc` where `newGRPCDialOptions` properly wires `cfg.tlsCfg` through WithTLSCredentials. As a workaround, explicitly supply `WithTLSCredentials` when configuring the exporter instead of relying solely on environment variables. Avoid depending on OTEL_EXPORTER_OTLP_LOGS_CERTIFICATE, OTEL_EXPORTER_OTLP_CERTIFICATE, or related client certificate variables unless the fix is applied.
Impact:
Users of the OTLP log gRPC exporter who configure TLS, CA pinning, or mTLS through environment variables are impacted when they do not also supply explicit WithTLSCredentials. TLS still occurs with system roots, but the intended private CA pinning and client certificate authentication are bypassed. An attacker with a suitable network position and a system-trusted certificate for the collector endpoint can intercept or tamper with log telemetry that operators expected to be protected by the configured CA or mTLS policy. This constitutes improper TLS certificate validation and endpoint authentication caused by ignoring configured trust material.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
