AI Sec Watch: A Security Intelligence Platform for AI Systems

Luu, T.J.

GHSA-wfr5-454p-mjc2: OpenTelemetry.Exporter.Instana bypasses TLS certificate validation when a proxy is configured

mediumvulnerability

security

Source: GitHub Advisory DatabaseMay 8, 2026CVE-2026-44213

Summary

The OpenTelemetry.Exporter.Instana NuGet package (a tool for monitoring application performance) disables TLS certificate validation (the security check that verifies a server's identity) when a proxy is configured using the INSTANA_ENDPOINT_PROXY environment variable. This means an attacker who intercepts the network connection could read sensitive telemetry data and steal the Instana API key (a credential that grants access to monitoring systems). The vulnerability only affects systems where a proxy is configured and that proxy is either controlled by an attacker or vulnerable to interception.

Solution / Mitigation

Pull request #4153 refactors the HttpClient creation so that TLS certificate validation is no longer disabled by default when using a proxy. For environments where disabling certificate validation is necessary (such as local development), the previous behavior can be restored by configuring a custom HttpClientFactory with ServerCertificateCustomValidationCallback set to accept any certificate, as shown in the code example provided in the remediation section.