{"id":"DEBIAN-CVE-2026-112006","details":"OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 contains an improper certificate validation vulnerability that disables TLS verification when OTEL_EXPORTER_OTLP_CERTIFICATE variables are empty strings. Man-in-the-middle attackers can impersonate the collector to read or alter exported traces, metrics, and logs, including authentication headers from OTEL_EXPORTER_OTLP_HEADERS.","modified":"2026-10-19T16:01:23.981614413Z","published":"2026-10-19T15:47:41.418304734Z","upstream":["CVE-2026-112006"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2026-112006"}],"affected":[{"package":{"name":"python-opentelemetry","ecosystem":"Debian:14","purl":"pkg:deb/debian/python-opentelemetry?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.35.0-2","1.38.0-1","1.38.0-2","1.39.1-1","1.39.1-2","1.40.0-1","1.41.0-1","1.41.0-2","1.42.1-1","1.43.0-1","1.44.0-1","1.44.0-2","1.45.1-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-112006.json"}}],"schema_version":"1.9.0"}