CVE-2026-112006 OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 Improper Certificate Validation
Man-in-the-middle attackers can intercept or modify telemetry data by exploiting disabled TLS verification when certificate environment variables are empty.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-112006?
CVE-2026-112006 is a high-severity vulnerability in opentelemetry-exporter-otlp-proto-http, published on 18 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 contains an improper certificate validation vulnerability that disables TLS verification when OTEL_EXPORTER_OTLP_CERTIFICATE variables are empty strings. Man-in-the-middle attackers can impersonate the collector to read or alter exported traces, metrics, and logs, including authentication headers from OTEL_EXPORTER_OTLP_HEADERS.
Weakness: CWE-295
Which versions are affected by CVE-2026-112006?
How do I fix CVE-2026-112006?
Upgrade to a fixed version.
Is CVE-2026-112006 being exploited?
There is no known exploitation of CVE-2026-112006 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-112006, GHSA-6469-8p9h-mmvm, UBUNTU-CVE-2026-112006.