CVE-2026-112006: OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 Improper Certificate Validation
OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 contains an improper certificate validation vulnerability that disables TLS verification when OTELEXPORTEROTLPCERTIFICATE variables are empty strings. Man-in-the-middle attackers can impersonate the collector to read or alter exported traces, metrics, and logs, including authentication headers from OTELEXPORTEROTLPHEADERS.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
opentelemetry/opentelemetry-exporter-otlp-proto-httpto a version that resolves this vulnerability.Fixed in 1.45.0
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using opentelemetry-exporter-otlp-proto-http from 1.5.0 up to, but not including, 1.45.0 are exposed when an OTEL_EXPORTER_OTLP_CERTIFICATE variable is set to an empty string.
What does an attacker need to exploit the vulnerability?
An attacker needs a man-in-the-middle position between the exporter and the OpenTelemetry collector. No privileges or user interaction are required, but the affected empty-string certificate environment-variable condition must be present.
What data could be exposed or modified?
An attacker impersonating the collector can read or alter exported traces, metrics, and logs. Authentication headers configured through OTEL_EXPORTER_OTLP_HEADERS may also be exposed.
How can I mitigate the issue if I cannot upgrade immediately?
Avoid setting OTEL_EXPORTER_OTLP_CERTIFICATE variables to empty strings, so TLS verification is not disabled. Upgrade to version 1.45.0 when possible.