Update OpenTelemetry to 1.45.0 to Block Certificate Bypass and Secure Telemetry Data

Security teams must verify their OpenTelemetry HTTP exporter configurations immediately. A vulnerability in the opentelemetry-exporter-otlp-proto-http component allows unauthenticated network attackers to bypass Transport Layer Security protections. This flaw affects all versions of the exporter released before 1.45.0. The issue arises when environment variables intended to define certificate paths are left empty. Instead of enforcing strict validation, the software defaults to skipping verification entirely. This creates a window for interception.

The risk

The flaw is classified as high severity with a CVSS score of 8.3. It maps to CWE-295, which covers improper certificate validation. When the OTEL_EXPORTER_OTLP_CERTIFICATE variable is set to an empty string, the exporter disables its check for trusted certificates. This behavior effectively turns off encryption verification for the connection between the exporter and the collector. An attacker positioned on the network can impersonate the legitimate collector. They can then read or modify the telemetry data in transit. This includes sensitive authentication headers sent via OTEL_EXPORTER_OTLP_HEADERS.

Who is exposed

Any environment using OpenTelemetry opentelemetry-exporter-otlp-proto-http versions prior to 1.45.0 is at risk. This includes applications and services that export traces, metrics, or logs to an OpenTelemetry collector. The exposure is active if the deployment uses the default or empty configuration for the certificate environment variable. Organizations relying on this exporter for observability pipelines must check their version numbers. As BlueTeam Herald reported on 2026-10-14, similar certificate validation flaws in other tools like Zoom have exposed sensitive data to network-based attacks. This pattern highlights the persistent danger of weak TLS defaults.

Cost and compliance

The source material does not specify financial costs or direct compliance mandates. However, the ability for attackers to read or alter exported traces and logs poses significant data integrity risks. Authentication headers may contain credentials or tokens that could be reused. Loss of confidentiality for telemetry data can violate internal security policies and data protection regulations. Organizations should assess the sensitivity of the data flowing through their exporters. If authentication tokens are exposed, the breach scope extends beyond observability data to potential account compromise.

Our take on the response

Teams should audit their OpenTelemetry exporter versions and environment configurations now. Confirm that no deployments run versions before 1.45.0. Ensure that OTEL_EXPORTER_OTLP_CERTIFICATE variables are either unset or point to valid certificate files, never empty strings. This configuration hardens the connection against impersonation. Monitoring network traffic for unexpected certificate errors can also reveal misconfigurations before exploitation occurs.

What defenders should look for

Teams usually detect this activity by reviewing network logs for failed TLS handshakes or unexpected certificate errors on telemetry ports. Check whether exporters are connecting to collector IPs that do not match known infrastructure. Look for anomalies in trace or metric data, such as sudden gaps or altered values, which may indicate interception. First containment moves include isolating affected exporters from the network and disabling the OTEL_EXPORTER_OTLP_HEADERS if they contain sensitive tokens. Verify that no unauthorized intermediate certificates are being accepted.

What to do and how to stay safe: OpenTelemetry

• Check all installations of opentelemetry-exporter-otlp-proto-http and upgrade to version 1.45.0 or later once available.
• Review environment variables to ensure OTEL_EXPORTER_OTLP_CERTIFICATE is not set to an empty string.
• Monitor network traffic between exporters and collectors for signs of man-in-the-middle activity or certificate warnings.
• Audit logs for unexpected modifications to telemetry data or authentication headers during transit.

Step-by-step guide: Unpatched Software Response: Containment, Recovery, and Prevention Steps

General security guidance from the BlueTeam Herald newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-112006?

The CVSS score is 8.3, which is rated as HIGH severity.

Which versions of OpenTelemetry are affected by this vulnerability?

All versions of opentelemetry-exporter-otlp-proto-http before 1.45.0 are affected.

How does the vulnerability allow attackers to bypass security?

It disables TLS verification when the OTEL_EXPORTER_OTLP_CERTIFICATE variable is an empty string.