CVE-2026-44213
Last modified
CVE-2026-44213 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. The OpenTelemetry.Exporter.Instana exports telemetry to Instana backend. Prior to 1.1.0, the OpenTelemetry.Exporter.Instana NuGet package does not validate HTTPS/TLS certificates are valid when sending telemetry to a configured Instana back-end when a proxy is configured using the INSTANA_ENDPOINT_PROXY environment variable. EPSS estimates a 0.21% chance of exploitation in the next 30 days.
Description
The OpenTelemetry.Exporter.Instana exports telemetry to Instana backend. Prior to 1.1.0, the OpenTelemetry.Exporter.Instana NuGet package does not validate HTTPS/TLS certificates are valid when sending telemetry to a configured Instana back-end when a proxy is configured using the INSTANA_ENDPOINT_PROXY environment variable. If a network attacker can Man-in-the-Middle (MitM) the proxy connection, all OpenTelemetry telemetry data and the Instana API key are exposed to the attacker. This vulnerability is fixed in 1.1.0.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| open-telemetry | opentelemetry-dotnet-contrib | < 1.1.0 |
References
Timeline
- Published
- Last Modified
- Status
- Awaiting Analysis
Frequently Asked Questions
What is CVE-2026-44213?
How severe is CVE-2026-44213?
How do I fix CVE-2026-44213?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-44207Frappe is a full-stack web application framework. Prior to v…6.9
- CVE-2026-44208Frappe is a full-stack web application framework. Prior to v…6.9
- CVE-2026-44209Banks generates meaningful LLM prompts using a template lang…7.5
- CVE-2026-44210Kata Containers is an open source project focusing on a stan…9.9
- CVE-2026-44211Cline is an autonomous coding agent as an SDK, IDE extension…9.6
- CVE-2026-44212PrestaShop is an open source e-commerce web application. Pri…9.3
- CVE-2026-44214eventsource-encoder encodes events as well-formed EventSourc…5.3
- CVE-2026-44215NanaZip is an open source file archive. From 5.0.1252.0 to b…7.1
- CVE-2026-44216Wasmtime is a runtime for WebAssembly. From 30.0.0 to 36.0.8…7.5
- CVE-2026-44217sse-channel is an SSE-implementation which can be used to an…6.6
- CVE-2026-44218ciguard is a static security auditor for CI/CD pipelines. Fr…3
- CVE-2026-44219ciguard is a static security auditor for CI/CD pipelines. Fr…3.7
Are you affected by CVE-2026-44213?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST