OpenTelemetry Python CVE-2026-112006

Requires the OTEL_EXPORTER_OTLP_CERTIFICATE (CA certificate) environment variable to be set to an empty string rather than unset or a valid path, which causes the opentelemetry-exporter-otlp-proto-http exporter to disable TLS certificate verification entirely. In addition, the attacker must occupy a man-in-the-middle / on-path position on the network between the exporter and the OTLP/HTTP collector endpoint (reflected as AT:P in the CVSS 4.0 vector). Limiting factors: this is a non-default misconfiguration (an empty-string value, not normal usage), it only matters when exporting over TLS to a remote collector, and it requires active network interception capability - all of which substantially narrow the exploitable population versus the raw CVSS score.

This is a genuine but conditional risk, not a drop-everything emergency. The CVSS 4.0 base score of 8.3 (HIGH) rests on AV:N/AC:L/PR:N/UI:N with VC:H, but the AT:P flag is decisive: successful attack REQUIRES an attacker to already hold a man-in-the-middle position on the network path between the exporter and the OTLP collector, AND the victim must have the OTEL_EXPORTER_OTLP_CERTIFICATE variable set to an empty string so TLS verification is silently disabled. No EPSS score, SSVC decision, or KEV entry was provided in the input, and there is no indication of active exploitation. The flaw was reported by VulnCheck and a vendor patch (v1.45.0) is available, but no public exploit code is referenced. The high confidentiality impact (VC:H) is credible because disabled TLS verification lets an on-path attacker read exported traces, metrics, and logs and, critically, the authentication headers carried in OTEL_EXPORTER_OTLP_HEADERS - those stolen credentials can enable follow-on access. Net: a real priority only for deployments that both (a) run TLS-protected OTLP over HTTP and (b) set the certificate env var to an empty string, combined with an attacker who can intercept traffic; for everyone else the practical risk is low. The AT:P requirement and the empty-string misconfiguration gate are the key factors that temper the otherwise high base score.

An attacker positioned on the network path (e.g. a compromised intermediary, rogue proxy, or ARP-spoofing peer on a shared segment) between an application and its OTLP collector detects that the exporter has TLS verification disabled because OTEL_EXPORTER_OTLP_CERTIFICATE is an empty string. The attacker presents a forged TLS certificate, impersonates the legitimate collector, and transparently intercepts the telemetry stream - harvesting the OTEL_EXPORTER_OTLP_HEADERS authentication tokens and optionally altering the traces, metrics, and logs before relaying them. No public exploit code is identified at time of analysis, but the technique is standard MITM interception requiring no special tooling.