OpenTelemetry opentelemetry-exporter-otlp-proto-http: Improper certificate validation

Summary

The Python package opentelemetry-exporter-otlp-proto-http disables TLS certificate verification when the OTEL_EXPORTER_OTLP_CERTIFICATE variables are set to empty strings. A man-in-the-middle attacker on the network path can impersonate the collector and read or alter exported traces, metrics and logs, including authentication headers configured in OTEL_EXPORTER_OTLP_HEADERS. No authentication is required, but the attacker needs a suitable on-path position.

Affected

• opentelemetry-exporter-otlp-proto-http 1.5.0 up to, but not including, 1.45.0 (boundary to be verified against the fix commit)
• Only if OTEL_EXPORTER_OTLP_CERTIFICATE (or the traces variant) is set to an empty string
• Distribution packages: NixOS tracking issue lists 1.43.0 and 1.34.0 (release-25.11); Ubuntu 26.04 LTS and 26.10 are under evaluation

Fixed in

• Upgrade to the latest 1.45.x release (1.45.0 is referenced by the CVE; 1.45.1 exists but its fix content is unverified)
• Fix commit: 89cc68b9ea7e15969b4f042d63397bdc74a3d60e
• Vendor advisory: Unknown.

Workaround

• Check configurations, containers and CI for OTEL_EXPORTER_OTLP_*CERTIFICATE variables with empty values
• Remove these variables or point them to a valid CA certificate file
• No workaround is documented by the vendor.

Exploitation

• No reports of exploitation in the wild found.
• Not listed in the CISA KEV catalogue (as far as checked).
• CISA SSVC: Exploitation none, Automatable no, Technical Impact partial.
• No public proof of concept found.

Our recommendation

• Inventory Python services that use the OTLP HTTP exporter.
• Check for empty OTEL_EXPORTER_OTLP_*CERTIFICATE variables and remove them or set a valid CA file.
• Upgrade to the latest 1.45.x release and verify the fixed version.
• Prioritise services that send telemetry over untrusted networks or the internet.
• Medium priority.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CVE-2026-112006 VulnCheck advisory www.vulncheck.com
• Fix commit 89cc68b9 github.com
• OpenTelemetry Python v1.45.0 release github.com
• Vulnerable code in v1.44.0 (exporter init) github.com
• Ubuntu security notice CVE-2026-112006 ubuntu.com
• OpenTelemetry environment variables reference opentelemetry-python.readthedocs.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 13:36.