CVE-2026-44213 OpenTelemetry.Exporter.Instana bypasses TLS certificate validation when a proxy is configured
A network attacker can intercept telemetry and API keys via Man-in-the-Middle attacks when a proxy is configured, due to disabled TLS certificate validation.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-44213?
CVE-2026-44213 is a medium-severity vulnerability in open-telemetry opentelemetry-dotnet-contrib, published on 26 May 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
The OpenTelemetry.Exporter.Instana exports telemetry to Instana backend. Prior to 1.1.0, the OpenTelemetry.Exporter.Instana NuGet package does not validate HTTPS/TLS certificates are valid when sending telemetry to a configured Instana back-end when a proxy is configured using the INSTANA_ENDPOINT_PROXY environment variable. If a network attacker can Man-in-the-Middle (MitM) the proxy connection, all OpenTelemetry telemetry data and the Instana API key are exposed to the attacker. This vulnerability is fixed in 1.1.0.
Weakness: CWE-295
Which versions are affected by CVE-2026-44213?
2 open source packages ship an affected version, including OpenTelemetry.Exporter.Instana.
| Package | Affected | Fixed in |
|---|---|---|
OpenTelemetry.Exporter.Instana NuGet | All versions | 1.1.0 |
OpenTelemetry.Exporter.Instana NuGet | All versions | 1.1.0 |
How do I fix CVE-2026-44213?
Upgrade OpenTelemetry.Exporter.Instana to 1.1.0 or later.
Is CVE-2026-44213 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-44213 exists.
Sources
Also known as GHSA-wfr5-454p-mjc2.