{"id":"CVE-2026-112006","kind":"vulnerability","aliases":["CVE-2026-112006"],"related":[],"title":"OpenTelemetry OTLP HTTP exporter skips TLS checks when certificate variables are empty","description":"OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 contains an improper certificate validation vulnerability that disables TLS verification when OTEL_EXPORTER_OTLP_CERTIFICATE variables are empty strings. Man-in-the-middle attackers can impersonate the collector to read or alter exported traces, metrics, and logs, including authentication headers from OTEL_EXPORTER_OTLP_HEADERS.","summary":"The opentelemetry-exporter-otlp-proto-http Python package from version 1.5.0 before 1.45.0 disables TLS certificate verification when the OTEL_EXPORTER_OTLP_CERTIFICATE variables are set to empty strings. A man-in-the-middle attacker can impersonate the collector and read or alter exported traces, metrics and logs, including auth headers from OTEL_EXPORTER_OTLP_HEADERS.","severity":"high","cvss":8.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["observability","opentelemetry","package","python"],"not_affected_if":["certificate-vars-unset","grpc-exporter","trusted-network-only"],"how_to_check":"- Check the installed version with `pip show opentelemetry-exporter-otlp-proto-http` and look for a version below `1.45.0`.\n- Check whether `OTEL_EXPORTER_OTLP_CERTIFICATE` or `OTEL_EXPORTER_OTLP_TRACES_CERTIFICATE` / `OTEL_EXPORTER_OTLP_METRICS_CERTIFICATE` / `OTEL_EXPORTER_OTLP_LOGS_CERTIFICATE` are set to an empty value in deployment config or environment.","fix":"- Upgrade `opentelemetry-exporter-otlp-proto-http` to `1.45.0` or later.\n- Until upgraded, unset the empty `OTEL_EXPORTER_OTLP_*CERTIFICATE` variables so they are not blank strings.\n- Rotate any tokens sent in `OTEL_EXPORTER_OTLP_HEADERS` if traffic may have crossed an untrusted network.","status":"open","published_at":"2026-10-18T12:17:12+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T03:02:32+00:00","updated_at":"2026-10-25T03:02:32+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-25T03:02:32Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `opentelemetry-exporter-otlp-proto-http` to `1.45.0` or later.\n- Until upgraded, unset the empty `OTEL_EXPORTER_OTLP_*CERTIFICATE` variables so they are not blank strings.\n- Rotate any tokens sent in `OTEL_EXPORTER_OTLP_HEADERS` if traffic may have crossed an untrusted network.","reach":"network","title":"OpenTelemetry OTLP HTTP exporter skips TLS checks when certificate variables are empty","impact":"high","summary":"The opentelemetry-exporter-otlp-proto-http Python package from version 1.5.0 before 1.45.0 disables TLS certificate verification when the OTEL_EXPORTER_OTLP_CERTIFICATE variables are set to empty strings. A man-in-the-middle attacker can impersonate the collector and read or alter exported traces, metrics and logs, including auth headers from OTEL_EXPORTER_OTLP_HEADERS.","category":"package","nicknames":[],"who_cares":["python","opentelemetry","observability"],"confidence":0.8,"needs_auth":"no","worst_case":"attacker reads and alters telemetry, steals exporter auth headers","analyst_note":"Confirm the exact fixed version and whether the NVD record's 1.45.0 boundary is correct; check the OpenTelemetry Python release notes for the advisory.","how_to_check":"- Check the installed version with `pip show opentelemetry-exporter-otlp-proto-http` and look for a version below `1.45.0`.\n- Check whether `OTEL_EXPORTER_OTLP_CERTIFICATE` or `OTEL_EXPORTER_OTLP_TRACES_CERTIFICATE` / `OTEL_EXPORTER_OTLP_METRICS_CERTIFICATE` / `OTEL_EXPORTER_OTLP_LOGS_CERTIFICATE` are set to an empty value in deployment config or environment.","needs_analyst":true,"not_affected_if":["grpc-exporter","certificate-vars-unset","trusted-network-only"],"who_is_affected":"Applications that export telemetry over OTLP HTTP using this Python package from 1.5.0 up to 1.45.0, where the certificate variables are defined but empty. Exposure requires a network path between the app and the collector that an attacker can intercept. Teams whose exporters use gRPC, or who do not set the certificate variables at all, can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000796,"input_tokens":3399,"output_tokens":913,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-112006':15A,18A '-2026':14A,17A '1.45.0':36B,90C '1.5.0':34B,88C 'alter':67B,123C 'attack':59B,115C 'auth':74B 'authent':130C 'certif':9A,39B,46B,94C,105C 'check':7A 'collector':63B,119C 'contain':91C 'cve':13A,16A 'disabl':37B,98C 'empti':12A,51B,108C 'export':4A,26B,44B,68B,78B,84C,103C,124C,134C 'header':75B,80B,131C,136C 'http':3A,29B,87C 'imperson':61B,117C 'improp':93C 'includ':73B,129C 'log':72B,128C 'man':55B,111C 'man-in-the-middl':54B,110C 'metric':70B,126C 'middl':58B,114C 'observ':19B 'opentelemetri':1A,20B,25B,81C,83C 'opentelemetry-exporter-otlp-proto-http':24B,82C 'otel':43B,77B,102C,133C 'otlp':2A,27B,45B,79B,85C,104C,135C 'packag':21B,31B 'proto':28B,86C 'python':22B,30B 'read':65B,121C 'set':49B 'skip':5A 'string':52B,109C 'tls':6A,38B,99C 'trace':69B,125C 'valid':95C 'variabl':10A,47B,106C 'verif':40B,100C 'version':33B 'vulner':96C","nicknames":[],"mitigations":[],"who_affected":"Applications that export telemetry over OTLP HTTP using this Python package from 1.5.0 up to 1.45.0, where the certificate variables are defined but empty. Exposure requires a network path between the app and the collector that an attacker can intercept. Teams whose exporters use gRPC, or who do not set the certificate variables at all, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T12:17:12+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112006","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112006","severity":null,"published_at":"2026-10-18T12:17:12+00:00","modified_at":"2026-10-19T21:14:14+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}