---
id: "CVE-2026-112006"
kind: "vulnerability"
aliases: ["CVE-2026-112006"]
title: "OpenTelemetry OTLP HTTP exporter skips TLS checks when certificate variables are empty"
severity: "high"
cvss: 8.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["observability", "opentelemetry", "package", "python"]
not_affected_if: ["certificate-vars-unset", "grpc-exporter", "trusted-network-only"]
published_at: "2026-10-18T12:17:12+00:00"
first_seen_at: "2026-10-23T21:57:15+00:00"
updated_at: "2026-10-25T03:02:32+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112006", "first_seen_at": "2026-10-23T21:57:15+00:00"}]
---

# OpenTelemetry OTLP HTTP exporter skips TLS checks when certificate variables are empty

The opentelemetry-exporter-otlp-proto-http Python package from version 1.5.0 before 1.45.0 disables TLS certificate verification when the OTEL_EXPORTER_OTLP_CERTIFICATE variables are set to empty strings. A man-in-the-middle attacker can impersonate the collector and read or alter exported traces, metrics and logs, including auth headers from OTEL_EXPORTER_OTLP_HEADERS.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version with `pip show opentelemetry-exporter-otlp-proto-http` and look for a version below `1.45.0`.
- Check whether `OTEL_EXPORTER_OTLP_CERTIFICATE` or `OTEL_EXPORTER_OTLP_TRACES_CERTIFICATE` / `OTEL_EXPORTER_OTLP_METRICS_CERTIFICATE` / `OTEL_EXPORTER_OTLP_LOGS_CERTIFICATE` are set to an empty value in deployment config or environment.

## Fix

- Upgrade `opentelemetry-exporter-otlp-proto-http` to `1.45.0` or later.
- Until upgraded, unset the empty `OTEL_EXPORTER_OTLP_*CERTIFICATE` variables so they are not blank strings.
- Rotate any tokens sent in `OTEL_EXPORTER_OTLP_HEADERS` if traffic may have crossed an untrusted network.

## Timeline

- 2026-10-23T21:57:15+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112006

## From the sources

OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 contains an improper certificate validation vulnerability that disables TLS verification when OTEL_EXPORTER_OTLP_CERTIFICATE variables are empty strings. Man-in-the-middle attackers can impersonate the collector to read or alter exported traces, metrics, and logs, including authentication headers from OTEL_EXPORTER_OTLP_HEADERS.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_