PT-2026-39240 · Nuget · Opentelemetry.Exporter.Instana

Smartincostello · Published 2026-05-08 · Updated 2026-05-29 · CVE-2026-44213

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions OpenTelemetry.Exporter.Instana (affected versions not specified)

Description The OpenTelemetry.Exporter.Instana NuGet package fails to validate HTTPS/TLS certificates when sending telemetry to an Instana back-end if a proxy is configured via the INSTANA ENDPOINT PROXY environment variable. The Transport.ConfigureBackendClient() function creates an HttpClient instance that disables TLS server certificate validation. This allows a network attacker to perform a Man-in-the-Middle (MitM) attack—a technique where an attacker intercepts communication between two parties—to expose all OpenTelemetry telemetry data and the Instana API key.

Recommendations Do not configure the INSTANA ENDPOINT PROXY environment variable. As a temporary workaround, restrict the use of the INSTANA ENDPOINT PROXY environment variable to trusted environments only.

Exploit

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2026-44213

GHSA-WFR5-454P-MJC2

Affected Products

Opentelemetry.Exporter.Instana

References · 7

• 🔥 https://github.com/open-telemetry/opentelemetry-dotnet-contrib/security/advisories/GHSA-wfr5-454p-mjc2 · Exploit
• https://osv.dev/vulnerability/GHSA-wfr5-454p-mjc2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44213 · Security Note
• https://github.com/open-telemetry/opentelemetry-dotnet-contrib · Note
• https://t.me/CVEtracker/55028 · Telegram Post
• https://twitter.com/the_yellow_fall/status/2054372806796693850 · Twitter Post
• https://t.me/cveNotify/165224 · Telegram Post