CVE-2026-112006 Details
Description
OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 contains an improper certificate validation vulnerability that disables TLS verification when OTEL_EXPORTER_OTLP_CERTIFICATE variables are empty strings. Man-in-the-middle attackers can impersonate the collector to read or alter exported traces, metrics, and logs, including authentication headers from OTEL_EXPORTER_OTLP_HEADERS.
A vulnerability exists in OpenTelemetry's OTLP Proto HTTP exporter, specifically in versions 1.5.0 prior to 1.45.0. This vulnerability involves improper certificate validation, as it disables TLS verification when the OTEL_EXPORTER_OTLP_CERTIFICATE environment variable is an empty string. As a result, man-in-the-middle attackers can impersonate the collector and intercept or modify exported traces, metrics, and logs. This includes the ability to alter authentication headers specified in OTEL_EXPORTER_OTLP_HEADERS.
Users can upgrade to OpenTelemetry Exporter OTLP Proto HTTP version 1.45.0 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 18, 2026CISA-ADP
Assessed Oct 19, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-295 | Improper Certificate Validation | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| OpenTelemetry opentelemetry-exporter-otlp-proto-http | >= 1.5.0, < 1.45.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 19, 2026 | CVE Modified | CISA-ADP |
| Oct 18, 2026 | New CVE Received | [email protected] |