Live › vulnerability › CVE-2026-112006
Go to dashboardThe opentelemetry-exporter-otlp-proto-http Python package from version 1.5.0 before 1.45.0 disables TLS certificate verification when the OTEL_EXPORTER_OTLP_CERTIFICATE variables are set to empty strings. A man-in-the-middle attacker can impersonate the collector and read or alter exported traces, metrics and logs, including auth headers from OTEL_EXPORTER_OTLP_HEADERS.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications that export telemetry over OTLP HTTP using this Python package from 1.5.0 up to 1.45.0, where the certificate variables are defined but empty. Exposure requires a network path between the app and the collector that an attacker can intercept. Teams whose exporters use gRPC, or who do not set the certificate variables at all, can skip it.
No product ranges from the sources yet.
pip show opentelemetry-exporter-otlp-proto-http and look for a version below 1.45.0.OTEL_EXPORTER_OTLP_CERTIFICATE or OTEL_EXPORTER_OTLP_TRACES_CERTIFICATE / OTEL_EXPORTER_OTLP_METRICS_CERTIFICATE / OTEL_EXPORTER_OTLP_LOGS_CERTIFICATE are set to an empty value in deployment config or environment.opentelemetry-exporter-otlp-proto-http to 1.45.0 or later.OTEL_EXPORTER_OTLP_*CERTIFICATE variables so they are not blank strings.OTEL_EXPORTER_OTLP_HEADERS if traffic may have crossed an untrusted network.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 contains an improper certificate validation vulnerability that disables TLS verification when OTEL_EXPORTER_OTLP_CERTIFICATE variables are empty strings. Man-in-the-middle attackers can impersonate the collector to read or alter exported traces, metrics, and logs, including authentication headers from OTEL_EXPORTER_OTLP_HEADERS.
This page as .md · .json · in your agent: get_signal("CVE-2026-112006")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.