CVE-2026-112006
Received Received - Intake

Improper Certificate Validation in OpenTelemetry OTLP Proto HTTP Exporter

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: VulnCheck

Description
OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 contains an improper certificate validation vulnerability that disables TLS verification when OTEL_EXPORTER_OTLP_CERTIFICATE variables are empty strings. Man-in-the-middle attackers can impersonate the collector to read or alter exported traces, metrics, and logs, including authentication headers from OTEL_EXPORTER_OTLP_HEADERS.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-112006
EUVD
EUVD-2026-103459

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-295 The product does not validate, or incorrectly validates, a certificate.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects OpenTelemetry's opentelemetry-exporter-otlp-proto-http versions 1.5.0 to 1.44.0. When the OTEL_EXPORTER_OTLP_CERTIFICATE environment variable is set to an empty string, the system disables TLS verification. This allows attackers to perform man-in-the-middle attacks, impersonating the collector to intercept, read, or alter exported data such as traces, metrics, and logs. Sensitive authentication headers from OTEL_EXPORTER_OTLP_HEADERS may also be exposed.

Detection Guidance

Check if the OTEL_EXPORTER_OTLP_CERTIFICATE environment variable is set to an empty string in your OpenTelemetry exporter configuration. Inspect logs for TLS verification failures or unexpected certificate errors during OTLP exports.

Impact Analysis

If you use affected versions, attackers could intercept and manipulate your telemetry data, including traces, metrics, and logs. This could lead to unauthorized access to sensitive information, data tampering, or exposure of authentication headers. The impact includes potential data breaches, compromised system integrity, and loss of trust in your monitoring infrastructure.

Compliance Impact

This vulnerability could lead to unauthorized access or exposure of sensitive data, violating GDPR's data protection principles and HIPAA's requirements for safeguarding protected health information. Compliance failures may result in legal penalties, reputational damage, and loss of certification for organizations handling regulated data.

Mitigation Strategies

Upgrade to OpenTelemetry opentelemetry-exporter-otlp-proto-http version 1.45.0 or later. Ensure OTEL_EXPORTER_OTLP_CERTIFICATE is not set to an empty string and properly configured with valid certificate paths.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-112006. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart