Go Micro
Monthly
TLS certificate verification is disabled by default in go-micro before 6.0.0, allowing an unauthenticated on-path attacker to impersonate services and intercept or modify gRPC transport, HTTP and RabbitMQ broker, and Consul or etcd registry traffic - including authentication tokens and credentials. This is a genuine, structurally serious design defect (CWE-295, CVSS 9.1) rather than an inflated score, but successful exploitation requires both a TLS-enabled deployment that relies on the shared TLS helper and the attacker achieving a man-in-the-middle network position (reflected by AC:H and AT:P). No public exploit code and no confirmed active exploitation were identified at time of analysis; the vendor corrected the default in go-micro 6.0.0.
TLS certificate verification is disabled by default in go-micro before 6.0.0, allowing an unauthenticated on-path attacker to impersonate services and intercept or modify gRPC transport, HTTP and RabbitMQ broker, and Consul or etcd registry traffic - including authentication tokens and credentials. This is a genuine, structurally serious design defect (CWE-295, CVSS 9.1) rather than an inflated score, but successful exploitation requires both a TLS-enabled deployment that relies on the shared TLS helper and the attacker achieving a man-in-the-middle network position (reflected by AC:H and AT:P). No public exploit code and no confirmed active exploitation were identified at time of analysis; the vendor corrected the default in go-micro 6.0.0.