Bug 2554746 (CVE-2026-112006)

Summary: CVE-2026-112006 opentelemetry-exporter-otlp-proto-http: opentelemetry-exporter-otlp-proto-http: Information disclosure via improper TLS certificate validation
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: alinfoot, anpicker, anthomas, aprice, bbrownin, blitton, doconnor, dranck, dschmidt, dtrifiro, ebourniv, ehelms, gbenhaim, ggainey, hasun, ikhan, ilpinto, jdobes, jfula, jholecek, jlanda, jmitchel, jowilson, jpasqual, jsamir, juwatts, jwong, kaycoth, kshier, lbrazdil, ltomasbo, mbarnett, mdellweg, mhulan, mminar, niyer, nmoumoul, nyancey, oezr, omaciel, ometelka, orabin, osousa, pcreech, ptisnovs, rbiba, rbobbitt, rchan, sbunciak, simaishi, smallamp, sskracic, stcannon, syedriko, tmalecek, tpfromme, ttakamiy, twaugh, weaton, xdharmai, yguenane, ykashtan, zzhou
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in opentelemetry-exporter-otlp-proto-http. When certificate configuration environment variables are set to empty strings, Transport Layer Security (TLS) verification is unintentionally disabled. A man-in-the-middle attacker can exploit this improper certificate validation to impersonate the telemetry collector, leading to information disclosure and alteration of exported metrics, traces, logs, and authentication headers.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-18 11:41:21 UTC 
OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 contains an improper certificate validation vulnerability that disables TLS verification when OTEL_EXPORTER_OTLP_CERTIFICATE variables are empty strings. Man-in-the-middle attackers can impersonate the collector to read or alter exported traces, metrics, and logs, including authentication headers from OTEL_EXPORTER_OTLP_HEADERS.