6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-44213

CVE-2026-44213: OpenTelemetry.Exporter.Instana bypasses TLS certificate validation when a proxy is configured

The OpenTelemetry.Exporter.Instana exports telemetry to Instana backend. Prior to 1.1.0, the OpenTelemetry.Exporter.Instana NuGet package does not validate HTTPS/TLS certificates are valid when sending telemetry to a configured Instana back-end when a proxy is configured using the INSTANA_ENDPOINT_PROXY environment variable. If a network attacker can Man-in-the-Middle (MitM) the proxy connection, all OpenTelemetry telemetry data and the Instana API key are exposed to the attacker. This vulnerability is fixed in 1.1.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-44213

CVE-2026-44213:

6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
OpenTelemetry.Exporter.Instana	nuget	<= 1.0.7	1.1.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the OpenTelemetry.Exporter.Instana package, where the Transport.ConfigureBackendClient method improperly handles TLS certificate validation. When a proxy is configured via the INSTANA_ENDPOINT_PROXY environment variable, the code creates an HttpClient with a handler that unconditionally accepts all server certificates, effectively bypassing TLS validation. This flaw exposes telemetry data and the Instana API key to potential man-in-the-middle attacks.

The patch addresses this by refactoring the HttpClient creation process. The vulnerable ConfigureBackendClient method is removed and replaced with a CreateClient method. The new implementation no longer disables certificate validation by default. Instead, it provides a mechanism for users to supply their own HttpClient via the HttpClientFactory option, giving them control over the validation logic. This change ensures that TLS certificate validation is enabled by default, mitigating the risk of interception.

Vulnerable functions

OpenTelemetry.Exporter.Instana.Implementation.Transport.ConfigureBackendClient

src/OpenTelemetry.Exporter.Instana/Implementation/Transport.cs

The `ConfigureBackendClient` method in `OpenTelemetry.Exporter.Instana.Implementation.Transport` creates an `HttpClient` that disables TLS server certificate validation if the `INSTANA_ENDPOINT_PROXY` environment variable is configured. This allows a man-in-the-middle attacker to intercept and read all telemetry data and the Instana API key.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.