Improper Certificate Validation in OpenTelemetry Exporter by OpenTelemetry

CVE-2026-112006

What is CVE-2026-112006?

The OpenTelemetry exporter for OTLP over HTTP versions prior to 1.45.0 contain a critical vulnerability related to improper certificate validation. In scenarios where the OTEL_EXPORTER_OTLP_CERTIFICATE environment variable is set to an empty string, TLS verification is inadvertently disabled. This flaw poses a significant threat, allowing potential man-in-the-middle attackers to impersonate the telemetry collector. As a result, attackers could intercept and manipulate exported traces, metrics, and logs, effectively compromising sensitive data such as authentication headers that are transmitted through OTEL_EXPORTER_OTLP_HEADERS.

References