OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.21.0, the exporters/otlp/otlplog/otlploggrpc package loads OTEL_EXPORTER_OTLP_LOGS_CERTIFICATE, OTEL_EXPORTER_OTLP_CERTIFICATE, and related client certificate environment variables through loadEnvTLS into cfg.tlsCfg, but newGRPCDialOptions does not apply cfg.tlsCfg when creating gRPC transport credentials. The environment-only TLS path instead uses credentials.NewTLS with system roots and no configured client certificate, bypassing intended private CA pinning and mutual TLS unless the application also supplies WithTLSCredentials. A network attacker able to intercept or spoof the collector connection with a system-trusted certificate can read or alter log telemetry. This issue is fixed in version 0.21.0.

The remote SUSE Linux SLES16 / SLES_SAP16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:23984-1 advisory.

    - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad     SETTINGS_MAX_FRAME_SIZE       (bsc#1265758).
    - CVE-2026-35204: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary file write via specially crafted     plugin       (bsc#1261939).
    - CVE-2026-35205: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary code execution due to     insufficient plugin       provenance verification (bsc#1261935).
    - CVE-2026-35206: github.com/helm/helm: Helm: Files written to unexpected directory via specially crafted     Chart       (bsc#1261938).
    - CVE-2026-41178: go.opentelemetry.io/otel/baggage,go.opentelemetry.io/otel/propagation: no rejection of     raw-length       headers in baggage parsing allows for DoS via oversized inputs (bsc#1276510).
    - CVE-2026-41888: github.com/distribution/distribution/v3: tag deletion bypasses the     storage.delete.enabled       configuration (bsc#1265428).
    - CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth: Malicious registry can hijack Bearer token     realm to       exfiltrate credentials and refresh tokens (bsc#1270127).
    - CVE-2026-50151: oras-go: Credential forwarding via unvalidated Location header during blob upload     (bsc#1271660).
    - CVE-2026-50163: oras-go: Information disclosure and arbitrary file access via crafted tarball hardlinks     (bsc#1276327).
    - CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input     (bsc#1271997).
    - CVE-2026-56854: golang.org/x/crypto/ssh: source-address restriction bypassed in 5 callback families     (bsc#1281426).
    - CVE-2026-56855: golang.org/x/crypto/ssh: prevent DoS on deadlocked established channel (bsc#1281426).
    - CVE-2026-56864: x/mod/sumdb: ignore unrelated, unauthenticated hashes in Lookup (bsc#1275025).
    - CVE-2026-56865: x/mod/sumdb/tlog: fix transparency log tile verification bypass (bsc#1275024).
    - CVE-2026-78662: golang.org/x/crypto/ssh: prevent DoS on deadlocked undecided channel (bsc#1281426).
    - CVE-2026-81871: go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc: OpenTelemetry-Go: TLS     certificate bypass       allows log telemetry interception and alteration (bsc#1281468).
    - CVE-2026-81872: go.opentelemetry.io/otel/sdk/log: OpenTelemetry-Go: Denial of Service via attacker-     driven log emission       (bsc#1281469).
    - CVE-2026-85732: oras.land/oras-go/v2: blind SSRF via unvalidated Link header URL in pagination allows     internal network       probing (bsc#1281112).
    - gRPC-Go: several issues affecting the xDS RBAC authorization engine and the HTTP/2 transport server     implementation       (bsc#1276514).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES16 / SLES_SAP16 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:23990-1 advisory.

    - CVE-2026-81871: go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc: OpenTelemetry-Go: TLS     certificate bypass       allows log telemetry interception and alteration (bsc#1281468).
    - CVE-2026-81872: go.opentelemetry.io/otel/sdk/log: OpenTelemetry-Go: Denial of Service via attacker-     driven log emission       (bsc#1281469).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22010-1 advisory.

    - CVE-2026-81871: go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc: OpenTelemetry-Go: TLS     certificate bypass       allows log telemetry interception and alteration (bsc#1281468).
    - CVE-2026-81872: go.opentelemetry.io/otel/sdk/log: OpenTelemetry-Go: Denial of Service via attacker-     driven log emission       (bsc#1281469).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.21.0, the
    exporters/otlp/otlplog/otlploggrpc package loads OTEL_EXPORTER_OTLP_LOGS_CERTIFICATE,
    OTEL_EXPORTER_OTLP_CERTIFICATE, and related client certificate environment variables through loadEnvTLS
    into cfg.tlsCfg, but newGRPCDialOptions does not apply cfg.tlsCfg when creating gRPC transport
    credentials. The environment-only TLS path instead uses credentials.NewTLS with system roots and no
    configured client certificate, bypassing intended private CA pinning and mutual TLS unless the application
    also supplies WithTLSCredentials. A network attacker able to intercept or spoof the collector connection
    with a system-trusted certificate can read or alter log telemetry. This issue is fixed in version 0.21.0.
    (CVE-2026-81871)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21983-1 advisory.

    - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad     SETTINGS_MAX_FRAME_SIZE       (bsc#1265758).
    - CVE-2026-35204: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary file write via specially crafted     plugin       (bsc#1261939).
    - CVE-2026-35205: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary code execution due to     insufficient plugin       provenance verification (bsc#1261935).
    - CVE-2026-35206: github.com/helm/helm: Helm: Files written to unexpected directory via specially crafted     Chart       (bsc#1261938).
    - CVE-2026-41178: go.opentelemetry.io/otel/baggage,go.opentelemetry.io/otel/propagation: no rejection of     raw-length       headers in baggage parsing allows for DoS via oversized inputs (bsc#1276510).
    - CVE-2026-41888: github.com/distribution/distribution/v3: tag deletion bypasses the     storage.delete.enabled       configuration (bsc#1265428).
    - CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth: Malicious registry can hijack Bearer token     realm to       exfiltrate credentials and refresh tokens (bsc#1270127).
    - CVE-2026-50151: oras-go: Credential forwarding via unvalidated Location header during blob upload     (bsc#1271660).
    - CVE-2026-50163: oras-go: Information disclosure and arbitrary file access via crafted tarball hardlinks     (bsc#1276327).
    - CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input     (bsc#1271997).
    - CVE-2026-56854: golang.org/x/crypto/ssh: source-address restriction bypassed in 5 callback families     (bsc#1281426).
    - CVE-2026-56855: golang.org/x/crypto/ssh: prevent DoS on deadlocked established channel (bsc#1281426).
    - CVE-2026-56864: x/mod/sumdb: ignore unrelated, unauthenticated hashes in Lookup (bsc#1275025).
    - CVE-2026-56865: x/mod/sumdb/tlog: fix transparency log tile verification bypass (bsc#1275024).
    - CVE-2026-78662: golang.org/x/crypto/ssh: prevent DoS on deadlocked undecided channel (bsc#1281426).
    - CVE-2026-81871: go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc: OpenTelemetry-Go: TLS     certificate bypass       allows log telemetry interception and alteration (bsc#1281468).
    - CVE-2026-81872: go.opentelemetry.io/otel/sdk/log: OpenTelemetry-Go: Denial of Service via attacker-     driven log emission       (bsc#1281469).
    - CVE-2026-85732: oras.land/oras-go/v2: blind SSRF via unvalidated Link header URL in pagination allows     internal network       probing (bsc#1281112).
    - gRPC-Go: several issues affecting the xDS RBAC authorization engine and the HTTP/2 transport server     implementation       (bsc#1276514).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.21.0, the     exporters/otlp/otlplog/otlploggrpc package loads OTEL_EXPORTER_OTLP_LOGS_CERTIFICATE,     OTEL_EXPORTER_OTLP_CERTIFICATE, and related client certificate environment variables through loadEnvTLS     into cfg.tlsCfg, but newGRPCDialOptions does not apply cfg.tlsCfg when creating gRPC transport     credentials. The environment-only TLS path instead uses credentials.NewTLS with system roots and no     configured client certificate, bypassing intended private CA pinning and mutual TLS unless the application     also supplies WithTLSCredentials. A network attacker able to intercept or spoof the collector connection     with a system-trusted certificate can read or alter log telemetry. This issue is fixed in version 0.21.0.
    (CVE-2026-81871)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
363069	SUSE SLES16: helm / helm-bash-completion / helm-fish-completion / etc (SUSE-SU-2026:23984-1)	Nessus	SuSE Local Security Checks	Local	high
363067	SUSE SLES16 Security Update : distribution (SUSE-SU-2026:23990-1)	Nessus	SuSE Local Security Checks	Local	medium
362897	openSUSE 16 Security Update : distribution (openSUSE-SU-2026:22010-1)	Nessus	SuSE Local Security Checks	Local	medium
460545	Echo: go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc: security update to 0.21.0	Tenable Cloud Security	Echo Local Security Checks	Local	medium
460545	Echo: go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc: security update to 0.21.0	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
362531	openSUSE 16: helm / helm-bash-completion / helm-fish-completion / etc (openSUSE-SU-2026:21983-1)	Nessus	SuSE Local Security Checks	Local	high
348121	Linux Distros Unpatched Vulnerability : CVE-2026-81871	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-81871

medium

Tenable Plugins

high

medium

medium

medium

medium

high

medium