CVE-2026-112006: Improper Certificate Validation in OpenTelemetry opentelemetry-exporter-otlp-proto-http

The vulnerability in OpenTelemetry's opentelemetry-exporter-otlp-proto-http component affects versions >=1.5.0 and <1.45.0. When the OTEL_EXPORTER_OTLP_CERTIFICATE environment variables are empty strings, TLS certificate validation is improperly disabled. This allows an attacker positioned as a man-in-the-middle to impersonate the telemetry collector, intercepting or modifying exported traces, metrics, logs, and authentication headers. The CVSS 4.0 score is 8.3, indicating a high severity with network attack vector, low attack complexity, and partial impact on confidentiality and integrity.

An attacker exploiting this vulnerability can perform man-in-the-middle attacks to intercept or alter telemetry data sent to the collector. This includes sensitive information such as authentication headers, traces, metrics, and logs, potentially compromising confidentiality and integrity of monitoring data.

A fix is available in OpenTelemetry versions 1.45.0 and later. Users should upgrade to version 1.45.0 or newer to ensure proper TLS certificate validation. Until upgraded, avoid setting OTEL_EXPORTER_OTLP_CERTIFICATE environment variables to empty strings to prevent disabling TLS verification.