CVE-2026-112006 OpenTelemetry CVE debrief

Who should care

Defenders handling OpenTelemetry deployments, especially those with sensitive data or authentication headers, should assess exposure and prioritize updates. This includes operators managing OpenTelemetry installations, platform administrators responsible for system security, vulnerability management teams evaluating exposure, and security teams monitoring for potential man-in-the-middle attacks.

Why it matters

CVE-2026-112006 is a high-severity vulnerability in OpenTelemetry's opentelemetry-exporter-otlp-proto-http package. An improper certificate validation vulnerability exists when OTEL_EXPORTER_OTLP_CERTIFICATE variables are empty strings, disabling TLS verification. This allows man-in-the-middle attackers to impersonate the collector and potentially read or alter exported traces, metrics, and logs, including authentication headers. Defenders should prioritize verifying and updating affected systems, especially those handling sensitive data or authentication headers.

• Potential for man-in-the-middle attacks on exported data
• Possible exposure of authentication headers
• Risk of altered traces, metrics, and logs
• Need for verification of affected systems and updates

Technical summary

The opentelemetry-exporter-otlp-proto-http package, versions 1.5.0 before 1.45.0, is vulnerable to an improper certificate validation issue when OTEL_EXPORTER_OTLP_CERTIFICATE variables are set to empty strings. This causes TLS verification to be disabled, allowing attackers to impersonate the collector and potentially read or alter exported traces, metrics, and logs, including authentication headers. Defenders should prioritize verifying and updating affected systems, especially those handling sensitive data or authentication headers.

Defensive priority

Defenders should prioritize verifying and updating affected systems, especially those handling sensitive data or authentication headers.

Recommended defensive actions

• Verify and update opentelemetry-exporter-otlp-proto-http to version 1.45.0 or later
• Review and adjust OTEL_EXPORTER_OTLP_CERTIFICATE variables to ensure proper certificate validation
• Monitor for potential man-in-the-middle attacks on exported traces, metrics, and logs
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is confirmed in versions 1.5.0 before 1.45.0 of opentelemetry-exporter-otlp-proto-http. Evidence is based on official CVE and NVD records, as well as source references from [email protected].

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.