The OpenTelemetry opentelemetry‑exporter‑otlp‑proto‑http package (versions 1.5.0 through 1.44.x) contains an improper certificate validation flaw that disables TLS verification when the OTEL_EXPORTER_OTLP_CERTIFICATE environment variable is set to an empty string. This flaw allows an attacker who can influence the environment configuration to establish a man‑in‑the‑middle connection to the telemetry collector, intercepting, modifying, or injecting exported traces, metrics, and logs, and capturing authentication headers supplied through OTEL_EXPORTER_OTLP_HEADERS.

Affected by version 1.5.0 up to but not including 1.45.0 of the OpenTelemetry opentelemetry‑exporter‑otlp‑proto‑http package distributed by the OpenTelemetry project.

The CVSS score of 8.3 indicates a high severity vulnerability. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog. Exploitation requires that the application run with the OTEL_EXPORTER_OTLP_CERTIFICATE variable set to an empty string; an attacker with access to application configuration or the ability to set environment variables can trigger the flaw, leading to traffic interception and potential credential theft.