CVE-2026-105216
go-micro before 6.0.0 Disabled TLS Certificate Verification via tls.Config Helper
micro go-micro
CVSS
9.1CriticalExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.19%Chance of exploitation activity in the next 30 days, higher than 8% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 6.0.0go-microCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
go-micro before 6.0.0 contains an improper certificate validation vulnerability that allows network attackers to impersonate services because the shared TLS helper sets InsecureSkipVerify to true by default. Man-in-the-middle attackers can present any certificate to intercept or modify gRPC transport, HTTP and RabbitMQ broker, and Consul or etcd registry traffic, including authentication tokens and credentials.
Text from CVE List
Affected versions 1
- go-microaffected: all versions before 6.0.0CVE List
References 5
- github.com/micro/go-micro/commit/c7657f73f45cf839e643db10f28703eeab7299c3Fixvia CVE List
- vulncheck.com/advisories/go-micro-before-6.0.0-disabled-tls-certificate-verification-via-tls-config-helperAdvisoryvia CVE List
- github.com/micro/go-micro/issues/2963Referencevia CVE List
- github.com/micro/go-micro/blob/v5.30.0/internal/util/tls/tls.go#L43-L67Referencevia CVE List
- github.com/micro/go-microReferencevia CVE List