CVE-2026-112006 in opentelemetry-exporter-otlp-proto-http
Summary
by MITRE • 10/18/2026
OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 contains an improper certificate validation vulnerability that disables TLS verification when OTEL_EXPORTER_OTLP_CERTIFICATE variables are empty strings. Man-in-the-middle attackers can impersonate the collector to read or alter exported traces, metrics, and logs, including authentication headers from OTEL_EXPORTER_OTLP_HEADERS.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/18/2026
The OpenTelemetry project provides a comprehensive set of tools, APIs, and SDKs for collecting telemetry data such as traces, metrics, and logs from distributed systems. A critical security flaw was identified in the opentelemetry-exporter-otlp-proto-http component, specifically affecting versions prior to 1.45.0 when used with version 1.5.0 or later configurations that rely on specific environment variable settings. This vulnerability stems from an improper implementation of Transport Layer Security (TLS) certificate validation logic within the HTTP exporter module. The core issue arises when developers configure the telemetry export endpoint using the OTEL_EXPORTER_OTLP_CERTIFICATE environment variable but set its value to an empty string rather than omitting it entirely or providing a valid certificate path. In this specific configuration state, the underlying TLS library interprets the empty string as an instruction to disable all server certificate verification checks. This behavior deviates from secure defaults and creates a significant security gap in the data transmission pipeline.
From a technical perspective, TLS is designed to ensure confidentiality, integrity, and authenticity of communications over a network by verifying that the remote party possesses the private key corresponding to its public certificate. By disabling this validation due to an empty configuration value, the client application effectively operates without mutual authentication guarantees for the server identity. This means that any intermediate node on the network path can intercept the connection attempt and present a fraudulent certificate or no certificate at all without triggering a security alert in the OpenTelemetry exporter. The vulnerability is particularly insidious because it does not require complex exploitation techniques; it simply requires the presence of an empty string in a specific environment variable, which might occur during local development testing where developers inadvertently leave placeholder values in configuration files that are later deployed to production environments without review.
The operational impact of this flaw is severe for organizations relying on OpenTelemetry for observability and security monitoring. Attackers positioned as man-in-the-middle can intercept the unencrypted or falsely secured traffic between the application instrumented with OpenTelemetry and the collector endpoint. Since telemetry data often contains sensitive information about system architecture, performance bottlenecks, and potentially user interactions, this interception allows adversaries to read proprietary business logic and operational metrics. More critically, the vulnerability exposes authentication headers configured via OTEL_EXPORTER_OTLP_HEADERS. These headers frequently contain API keys, bearer tokens, or other credentials required for authenticating with backend services. An attacker who captures these headers can reuse them to impersonate legitimate clients, gaining unauthorized access to downstream systems that trust those credentials based on their presence in the telemetry stream rather than independent verification channels.
This vulnerability aligns closely with CWE-295 Improper Certificate Validation and CWE-319 Cleartext Transmission of Sensitive Information within the Common Weakness Enumeration framework. It also maps to MITRE ATT&CK technique T1078 Valid Accounts, as captured authentication headers can be leveraged for unauthorized access, and T1040 Network Sniffing if the traffic is intercepted in cleartext due to failed TLS negotiation or downgrade attacks facilitated by the lack of certificate pinning. The absence of strict validation allows attackers to perform session hijacking and data exfiltration with minimal effort once network-level interception capabilities are established.
To mitigate this risk, organizations must immediately upgrade the opentelemetry-exporter-otlp-proto-http package to version 1.45.0 or later, where the logic has been corrected to treat empty certificate strings as a request for default system trust store validation rather than disabling verification entirely. For environments that cannot update immediately, it is imperative to audit all deployment configurations and CI/CD pipelines to ensure that OTEL_EXPORTER_OTLP_CERTIFICATE is either omitted completely if using standard public certificates or populated with the correct path to a trusted CA bundle. Additionally, implementing strict configuration management practices and automated security scanning for environment variables can prevent accidental misconfigurations from reaching production systems. Regular penetration testing focused on TLS implementation details and monitoring for anomalous certificate validation errors in application logs are also recommended defensive measures to detect potential exploitation attempts or configuration drifts before they lead to a breach.