CVE-2026-112006Medium· 6.5▾ SunlitA flaw was found in opentelemetry-exporter-otlp-proto-http. When certificate configuration environment variables are set to empty strings, Transport Layer Security (TLS) verification is unintentionally disabled. A man-in-the-middle attacke…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
A flaw was found in opentelemetry-exporter-otlp-proto-http. When certificate configuration environment variables are set to empty strings, Transport Layer Security (TLS) verification is unintentionally disabled. A man-in-the-middle attacker can exploit this improper certificate validation to impersonate the telemetry collector, leading to information disclosure and alteration of exported metrics, traces, logs, and authentication headers.
opentelemetry-exporter-otlp-proto-http: opentelemetry-exporter-otlp-proto-http: Information disclosure via improper TLS certificate validation — rated Moderate by Red Hat. Released 2026-10-18.
Affected:
No fix planned:
Out of support scope
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-110220High· 7.1Kubeflow Model Registry through 0.3.17 contains a server-side request forgery vulnerability that allows namespace users to steal the controller ServiceAccount token via the modelregistry.kubeflow.org/url annotation
CVE-2026-109956High· 7.0NLTK through 3.10.3 contains a path traversal vulnerability in WekaClassifier that allows attackers to bypass nltk.pathsec containment by supplying unvalidated model paths
CVE-2026-107832Low· 3.7fastify is a fast and low overhead web framework for Node.js
CVE-2026-109156Medium· 6.3A vulnerability has been found in SeldonIO MLServer up to 1.6.1
CVE-2025-6193Medium· 5.9A command injection vulnerability was discovered in the TrustyAI Explainability toolkit
CVE-2026-108106High· 7.5Xerial snappy-java before 1.1.10.9 contains an unbounded memory allocation vulnerability that allows attackers to exhaust JVM memory by declaring a large uncompressed length in compressed input