Linux Distros Unpatched Vulnerability : CVE-2026-112006

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 contains an improper certificate validation vulnerability that disables TLS verificatio...

DEBIAN-CVE-2026-112006

OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 contains an improper certificate validation vulnerability that disables TLS verification when OTELEXPORTEROTLPCERTIFICATE variables are empty strings. Man-in-the-middle attackers can impersonate the collector to read or alte...

CVE-2026-112006

OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 contains an improper certificate validation vulnerability that disables TLS verification when OTELEXPORTEROTLPCERTIFICATE variables are empty strings. Man-in-the-middle attackers can impersonate the collector to read or alte...

CVE-2026-112006

A flaw was found in opentelemetry-exporter-otlp-proto-http. When certificate configuration environment variables are set to empty strings, Transport Layer Security TLS verification is unintentionally disabled. A man-in-the-middle attacker can exploit this improper certificate validation to...

CVE-2026-112006

OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 contains an improper certificate validation vulnerability that disables TLS verification when OTELEXPORTEROTLPCERTIFICATE variables are empty strings. Man-in-the-middle attackers can impersonate the collector to read or alte...

CVE-2026-112006 OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 Improper Certificate Validation

OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 contains an improper certificate validation vulnerability that disables TLS verification when OTELEXPORTEROTLPCERTIFICATE variables are empty strings. Man-in-the-middle attackers can impersonate the collector to read or alte...

CVE-2026-112006

The opentelemetry-exporter-otlp-proto-http library (versions 1.5.0 before 1.45.0) is vulnerable to improper certificate validation . The root cause is that TLS verification is disabled when the OTEL_EXPORTER_OTLP_CERTIFICATE variables are provided as empty strings. This allows man-in-the-middle a...

EUVD-2026-103459

OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 contains an improper certificate validation vulnerability that disables TLS verification when OTELEXPORTEROTLPCERTIFICATE variables are empty strings. Man-in-the-middle attackers can impersonate the collector to read or alte...

CVE-2026-112006 OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 Improper Certificate Validation

OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 contains an improper certificate validation vulnerability that disables TLS verification when OTELEXPORTEROTLPCERTIFICATE variables are empty strings. Man-in-the-middle attackers can impersonate the collector to read or alte...

CVE-2026-112006

OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 contains an improper certificate validation vulnerability that disables TLS verification when OTELEXPORTEROTLPCERTIFICATE variables are empty strings. Man-in-the-middle attackers can impersonate the collector to read or alte...

CVE-2026-112006: Improper Certificate Validation

OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 contains an improper certificate validation vulnerability that disables TLS verification when OTELEXPORTEROTLPCERTIFICATE variables are empty strings. Man-in-the-middle attackers can impersonate the collector to read or alte...

PT-2026-116610

OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 contains an improper certificate validation vulnerability that disables TLS verification when OTEL EXPORTER OTLP CERTIFICATE variables are empty strings. Man-in-the-middle attackers can impersonate the collector to read or...

Malicious code in opentelemetry-exporter-otlp-http (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-15763 Malicious code in opentelemetry-exporter-otlp-http (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

opentelemetry-exporter-datadog (>=0.12.0b0, <=0.18.0b1) potentially affected by CVE-2026-50271 via ddtrace (1.10.3)

ddtrace PYPI version 1.10.3 is affected by a known vulnerability. The following packages have a transitive dependency on ddtrace and may be impacted: - opentelemetry-exporter-datadog =0.12.0b0, =0.18.0b1 Source cves: CVE-2026-50271 Source advisory: OSV:PYSEC-2026-3461...

opentelemetry-exporter-datadog (>=0.20.0b0, <=0.30.0b0) potentially affected by CVE-2026-50271 via ddtrace (0.46.0)

ddtrace PYPI version 0.46.0 is affected by a known vulnerability. The following packages have a transitive dependency on ddtrace and may be impacted: - opentelemetry-exporter-datadog =0.20.0b0, =0.30.0b0 Source cves: CVE-2026-50271 Source advisory: OSV:PYSEC-2026-3461...

opentelemetry-exporter-datadog (>=0.20.0b0, <=0.30.0b0) potentially affected by CVE-2026-50271 via ddtrace (0.46.0)

ddtrace PYPI version 0.46.0 is affected by a known vulnerability. The following packages have a transitive dependency on ddtrace and may be impacted: - opentelemetry-exporter-datadog =0.20.0b0, =0.30.0b0 Source cves: CVE-2026-50271 Source advisory: OSV:GHSA-MW54-J2V2-42HR...

opentelemetry-exporter-datadog (>=0.12.0b0, <=0.18.0b1) potentially affected by CVE-2026-50271 via ddtrace (1.10.3)

ddtrace PYPI version 1.10.3 is affected by a known vulnerability. The following packages have a transitive dependency on ddtrace and may be impacted: - opentelemetry-exporter-datadog =0.12.0b0, =0.18.0b1 Source cves: CVE-2026-50271 Source advisory: OSV:GHSA-MW54-J2V2-42HR...

0perator (>=0.1.0, <=0.3.0), 0pflow (>=0.1.0-dev.00aaa03, <=0.1.0) +2211 more potentially affected by CVE-2026-44902 via @opentelemetry/exporter-prometheus (>=0.9.0, <=0.216.0)

@opentelemetry/exporter-prometheus NPM version =0.9.0, =0.1.0, =0.1.0-dev.00aaa03, =0.1.1, =0.1.0, =0.0.1, =1.0.21, =0.0.1, =0.8.0, =0.1.1, =0.1.1, =0.1.1, =0.1.8, =0.1.5, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.0.65, =0.0.68 and more Source cves: CVE-2026-44902 Source advisor...

CVE-2026-44213 OpenTelemetry.Exporter.Instana bypasses TLS certificate validation when a proxy is configured

The OpenTelemetry.Exporter.Instana exports telemetry to Instana backend. Prior to 1.1.0, the OpenTelemetry.Exporter.Instana NuGet package does not validate HTTPS/TLS certificates are valid when sending telemetry to a configured Instana back-end when a proxy is configured using the...