The OpenTelemetry.Exporter.Instana NuGet package versions before 1.1.0 do not properly validate TLS certificates when telemetry data is sent to an Instana backend through a proxy configured by the INSTANA_ENDPOINT_PROXY environment variable. This improper certificate validation (CWE-295) can be exploited by a network attacker performing a Man-in-the-Middle attack on the proxy connection, potentially exposing all telemetry data and the Instana API key. The vulnerability is resolved in version 1.1.0 of the package.

If exploited, an attacker able to MitM the proxy connection can access sensitive telemetry data and the Instana API key, leading to confidentiality breaches. There is no indication of impact on integrity or availability. The vulnerability requires the use of a proxy configured via the specific environment variable and network attacker capability to intercept the proxy connection.

Upgrade the OpenTelemetry.Exporter.Instana NuGet package to version 1.1.0 or later, where this certificate validation issue is fixed. Since no official patch link or advisory is provided, verify the upgrade through the vendor's release notes or repository. Avoid using vulnerable versions (<1.1.0) especially in environments where proxy usage is configured via INSTANA_ENDPOINT_PROXY. Patch status is not explicitly confirmed in a vendor advisory, so check the vendor's official sources for the latest remediation guidance.