go-micro: Disabled TLS certificate verification by default

Summary

go-micro is a Go framework for distributed systems. Its shared TLS helper sets InsecureSkipVerify to true by default, so TLS certificate verification is disabled for gRPC, HTTP, RabbitMQ broker, Consul and etcd connections. A network attacker in a man-in-the-middle position can present any certificate, intercept or modify traffic, and capture authentication tokens and credentials. The vulnerable default applies only to affected go-micro versions in services that use this helper.

Affected

• go-micro versions before 6.0.0 (according to the CVE record, affected 0 to < 6.0.0)
• The v5.30.0 source shows the insecure default in internal/util/tls/tls.go
• Only applications that build on go-micro are affected

Fixed in

• Upgrade to go-micro 6.0.0 or later (the CVE record names 6.0.0 as the fixed version; later v6 releases exist)
• Unverified: whether 6.0.0 changes the default to secure, and the exact fix commit. Check the vendor references directly.

Workaround

• For v5 deployments: set the environment variable MICRO_TLS_SECURE=true so certificate verification is enabled (documented by the vendor; coverage of all code paths is not confirmed)
• Restrict network access between services, brokers and registries to reduce on-path exposure
• Use proper CA-signed certificates or mutual TLS where possible

Exploitation

• CISA SSVC: exploitation none, automatable no, technical impact partial
• No evidence of exploitation in the wild or public proof of concept found
• EPSS 0.00194 (low predicted exploitation probability)
• An attacker must be able to position themselves on the network path

Our recommendation

• Check go.mod and go.sum for go-micro.dev or github.com/micro/go-micro to determine whether you are affected
• Plan an upgrade to go-micro 6.0.0 or later and test the changes
• Until patched, set MICRO_TLS_SECURE=true on v5 deployments and restrict network paths between services
• Monitor the NVD and GitHub security advisories for updates, since the NVD status is still Awaiting Analysis
• Priority: medium for typical SMEs without go-micro, high for services that use it on untrusted networks

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• VulnCheck advisory www.vulncheck.com
• go-micro TLS helper source (v5.30.0) github.com
• go-micro fix commit github.com
• go-micro issue #2963 github.com
• go-micro repository github.com
• VulDB CVE entry vuldb.com
• Vulners (EPSS, CVSS 3.1) vulners.com
• go-micro v5 TLS documentation pkg.go.dev

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 07:34.