Threats tagged 'ghsa-p6q5-cmw8-pqqg'

go-micro versions before 6.0.0 have an improper certificate validation vulnerability where the shared TLS helper sets InsecureSkipVerify to true by default. This allows network attackers to impersonate services and perform man-in-the-middle attacks, intercepting or modifying gRPC transport, HTTP and RabbitMQ broker, and Consul or etcd registry traffic, including sensitive authentication tokens and credentials.