p PatchFirst

CVE-2026-112006

CVE-2026-112006 · OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 Improper Certificate Validation

This page contains facts from public vulnerability sources. Check the original advisory before updating.

OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 contains an improper certificate validation vulnerability that disables TLS verification when OTEL_EXPORTER_OTLP_CERTIFICATE variables are empty strings. Man-in-the-middle attackers can impersonate the collector to read or alter exported traces, metrics, and logs, including authentication headers from OTEL_EXPORTER_OTLP_HEADERS.

CVSS 8.3 · High · EPSS 0.2% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • opentelemetry-exporter-otlp-proto-http

    Versions
    • ≥ 1.5.0, < 1.45.0: Affected (semver)

    Update to 1.45.0

  • python-opentelemetry Debian:14

    Versions
    • 1.35.0-2
    • 1.38.0-1
    • 1.38.0-2
    • 1.39.1-1
    • 1.39.1-2
    • 1.40.0-1
    • 1.41.0-1
    • 1.41.0-2
    • 1.42.1-1
    • 1.43.0-1
    • 1.44.0-1
    • 1.44.0-2
    • 1.45.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-opentelemetry Ubuntu:26.10

    Versions
    • 1.39.1-2
    • 1.42.1-1
    • 1.43.0-1
    • 1.44.0-1
    • 1.44.0-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-opentelemetry Ubuntu:26.04:LTS

    Versions
    • 1.38.0-1
    • 1.38.0-2
    • 1.39.1-1
    • 1.39.1-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →