CVE-2026-112006
OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 Improper Certificate Validation
OpenTelemetry opentelemetry-exporter-otlp-proto-http
CVSS
8.3HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.21%Chance of exploitation activity in the next 30 days, higher than 11% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 1.45.0opentelemetry-exporter-otlp-proto-httpCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 contains an improper certificate validation vulnerability that disables TLS verification when OTEL_EXPORTER_OTLP_CERTIFICATE variables are empty strings. Man-in-the-middle attackers can impersonate the collector to read or alter exported traces, metrics, and logs, including authentication headers from OTEL_EXPORTER_OTLP_HEADERS.
Text from CVE List
Affected versions 1
- opentelemetry-exporter-otlp-proto-httpaffected: 1.5.0 before 1.45.0CVE List
References 5
- github.com/open-telemetry/opentelemetry-python/commit/89cc68b9ea7e15969b4f042d63397bdc74a3d60eFixvia CVE List
- github.com/open-telemetry/opentelemetry-python/releases/tag/v1.45.0Fixvia CVE List
- vulncheck.com/advisories/opentelemetry-opentelemetry-exporter-otlp-proto-http-1.5.0-before-1.45.0-improper-certificate-validationAdvisoryvia CVE List
- github.com/open-telemetry/opentelemetry-python/blob/v1.44.0/exporter/opentelemetry-exporter-otlp-proto-http/src/opentelemetry/exporter/otlp/proto/http/trace_exporter/__init__.py#L93-L96Referencevia CVE List
- github.com/open-telemetry/opentelemetry-python/blob/v1.44.0/exporter/opentelemetry-exporter-otlp-proto-http/src/opentelemetry/exporter/otlp/proto/http/trace_exporter/__init__.py#L170-L185Referencevia CVE List