OpenTelemetry TLS Bypass Exposes Telemetry Data to Man-in-the-Middle Attacks

OpenTelemetry opentelemetry-exporter-otlp-proto-http versions earlier than 1.45.0 contain an improper certificate validation flaw. This vulnerability, tracked as CVE-2026-112006, disables TLS verification when specific environment variables are set to empty strings. The National Vulnerability Database rates the issue at 8.3, classifying it as high severity. Organizations using these components must verify their current versions and assess exposure to network-based interception.

How it unfolded

• The National Vulnerability Database published the record for CVE-2026-112006, detailing the improper certificate validation weakness.
• The entry identifies CWE-295 as the underlying technical cause, linking the flaw to a failure in validating cryptographic certificates.
• The description specifies that the vulnerability exists in the opentelemetry-exporter-otlp-proto-http component from version 1.5.0 up to, but not including, version 1.45.0.

Who is affected

Systems running OpenTelemetry opentelemetry-exporter-otlp-proto-http before version 1.45.0 are vulnerable. According to the NVD record, the flaw allows man-in-the-middle attackers to impersonate the collector. This enables adversaries to read or alter exported data, including traces, metrics, and logs. The vulnerability specifically permits access to authentication headers contained within OTEL_EXPORTER_OTLP_HEADERS. Any deployment relying on this HTTP exporter for telemetry transmission is at risk if certificate validation is bypassed by empty variable strings.

Our take on the response

The classification of this flaw as high severity reflects the direct access it grants to sensitive telemetry data. By disabling TLS verification, the vulnerability removes a critical layer of security for data in transit. That suggests organizations relying on OpenTelemetry for monitoring must treat this as an urgent patching priority, particularly for systems handling authentication headers or sensitive metrics. The wide version range indicates a long-standing exposure window that requires immediate inventory checks.

Who needs to act first

Teams should prioritize systems exposed to untrusted networks or handling sensitive authentication data. Check whether any servers or agents use the affected HTTP exporter versions before 1.45.0. Roll out updates to the latest stable version to restore proper certificate validation. Test the fix in a non-production environment first to ensure telemetry pipelines remain functional. Back up configurations before making changes. If immediate patching is not possible, restrict network access to the collector endpoints to reduce the attack surface for potential impersonation attempts.

What to do and how to stay safe: OpenTelemetry

• Audit all environments to identify instances of opentelemetry-exporter-otlp-proto-http running versions prior to 1.45.0.
• Apply the vendor update to version 1.45.0 or later once available to restore TLS certificate validation.
• Monitor network traffic for anomalies that could indicate man-in-the-middle interception attempts.
• Verify that environment variables for certificate paths are not set to empty strings in your configurations.

Step-by-step guide: Vulnerability Prioritization: How to Rank Risks Without Wasting Time

General security guidance from the Patch Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-112006?

The National Vulnerability Database assigns a CVSS score of 8.3, which is rated as high severity.

Which OpenTelemetry component is affected by this vulnerability?

The opentelemetry-exporter-otlp-proto-http component is affected in versions 1.5.0 through those before 1.45.0.

How can attackers exploit this flaw?

Man-in-the-middle attackers can impersonate the collector to read or alter exported traces, metrics, logs, and authentication headers.