Insecure Telemetry Exporter in OpenTelemetry Package by OpenTelemetry

CVE-2026-44213

What is CVE-2026-44213?

The OpenTelemetry.Exporter.Instana NuGet package is affected by a vulnerability that arises when the proper validation of HTTPS/TLS certificates is not enforced while exporting telemetry data to the Instana backend. Specifically, prior to version 1.1.0, if a proxy is configured using the INSTANA_ENDPOINT_PROXY environment variable, an attacker can exploit the lack of certificate validation to intercept the telemetry data. This could lead to exposure of sensitive data, including the Instana API key, if a Man-in-the-Middle (MitM) attack is performed against the proxy connection. The vulnerability has been addressed in version 1.1.0.

References