Opentelemetry Exporter Otlp Proto Http
Monthly
TLS certificate verification in the OpenTelemetry Python OTLP/HTTP exporter is silently disabled when the OTEL_EXPORTER_OTLP_CERTIFICATE environment variable is set to an empty string, allowing an unauthenticated on-path attacker to impersonate the OTLP collector and read or tamper with exported traces, metrics and logs - including the authentication headers configured via OTEL_EXPORTER_OTLP_HEADERS. Only deployments running opentelemetry-exporter-otlp-proto-http 1.5.0 through 1.44.x that export over TLS to a remote collector and carry this specific misconfiguration (empty string rather than unset or a valid CA bundle path) are exposed, and exploitation additionally requires the attacker to occupy a man-in-the-middle position on the export path. There is no CISA KEV listing and no public exploit identified at time of analysis, so this is a genuine but conditional risk rather than an emergency: the vendor has released a fix in 1.45.0.
TLS certificate verification in the OpenTelemetry Python OTLP/HTTP exporter is silently disabled when the OTEL_EXPORTER_OTLP_CERTIFICATE environment variable is set to an empty string, allowing an unauthenticated on-path attacker to impersonate the OTLP collector and read or tamper with exported traces, metrics and logs - including the authentication headers configured via OTEL_EXPORTER_OTLP_HEADERS. Only deployments running opentelemetry-exporter-otlp-proto-http 1.5.0 through 1.44.x that export over TLS to a remote collector and carry this specific misconfiguration (empty string rather than unset or a valid CA bundle path) are exposed, and exploitation additionally requires the attacker to occupy a man-in-the-middle position on the export path. There is no CISA KEV listing and no public exploit identified at time of analysis, so this is a genuine but conditional risk rather than an emergency: the vendor has released a fix in 1.45.0.