The vulnerability CVE-2026-81871 affects OpenTelemetry-Go's gRPC log exporter used in Red Hat Hardened Images RPMs, specifically grafana13.2. The flaw allows a network attacker to bypass intended private Certificate Authority pinning and mutual TLS configurations because the environment-only TLS path incorrectly trusts system certificates instead of the application's configured client certificates. This can lead to interception and spoofing of the collector connection, enabling unauthorized reading or alteration of sensitive log telemetry data. Red Hat has released updated RPMs (grafana13.2-13.2.1-0.5.hum1) to address this issue as part of a security advisory RHSA-2026:68778.

An attacker on the network can bypass TLS certificate validation mechanisms intended to secure log telemetry transport, potentially intercepting or altering sensitive telemetry data. This undermines the confidentiality and integrity of log data transmitted via OpenTelemetry-Go's gRPC log exporter. The impact is rated as high by Red Hat due to the ability to compromise secure communication channels without requiring privileges or user interaction.

An official security update is available from Red Hat for the affected packages. Users should apply the updated RPMs (grafana13.2-13.2.1-0.5.hum1) as provided in Red Hat advisory RHSA-2026:68778. No additional mitigations are specified or required beyond applying the official update.