🔐 CVE Alert

CVE-2026-112006

MEDIUM 6.5

OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 Improper Certificate Validation

CVSS Score
6.5
EPSS Score
0.0%
EPSS Percentile
0th

OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 contains an improper certificate validation vulnerability that disables TLS verification when OTEL_EXPORTER_OTLP_CERTIFICATE variables are empty strings. Man-in-the-middle attackers can impersonate the collector to read or alter exported traces, metrics, and logs, including authentication headers from OTEL_EXPORTER_OTLP_HEADERS.

CWE CWE-295
Vendor opentelemetry
Product opentelemetry-exporter-otlp-proto-http
Published Oct 18, 2026
Stay Ahead of the Next One

Get instant alerts for opentelemetry opentelemetry-exporter-otlp-proto-http

Be the first to know when new medium vulnerabilities affecting opentelemetry opentelemetry-exporter-otlp-proto-http are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
Low
Availability
None

Affected Versions

OpenTelemetry / opentelemetry-exporter-otlp-proto-http
1.5.0 < 1.45.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗
github.com: https://github.com/open-telemetry/opentelemetry-python/commit/89cc68b9ea7e15969b4f042d63397bdc74a3d60e github.com: https://github.com/open-telemetry/opentelemetry-python/releases/tag/v1.45.0 github.com: https://github.com/open-telemetry/opentelemetry-python/blob/v1.44.0/exporter/opentelemetry-exporter-otlp-proto-http/src/opentelemetry/exporter/otlp/proto/http/trace_exporter/__init__.py#L93-L96 github.com: https://github.com/open-telemetry/opentelemetry-python/blob/v1.44.0/exporter/opentelemetry-exporter-otlp-proto-http/src/opentelemetry/exporter/otlp/proto/http/trace_exporter/__init__.py#L170-L185 vulncheck.com: https://www.vulncheck.com/advisories/opentelemetry-opentelemetry-exporter-otlp-proto-http-1.5.0-before-1.45.0-improper-certificate-validation

Credits

Fawwaz Musaffa