Medium severity6.5GHSA Advisory· Published May 26, 2026· Updated May 29, 2026

CVE-2026-44213

Description

The OpenTelemetry.Exporter.Instana exports telemetry to Instana backend. Prior to 1.1.0, the OpenTelemetry.Exporter.Instana NuGet package does not validate HTTPS/TLS certificates are valid when sending telemetry to a configured Instana back-end when a proxy is configured using the INSTANA_ENDPOINT_PROXY environment variable. If a network attacker can Man-in-the-Middle (MitM) the proxy connection, all OpenTelemetry telemetry data and the Instana API key are exposed to the attacker. This vulnerability is fixed in 1.1.0.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
OpenTelemetry.Exporter.InstanaNuGet	< 1.1.0	1.1.0

Affected products

Opentelemetry/Opentelemetry Dotnet ContribGHSA
Range: <= 1.0.7
ghsa-coords
pkg:nuget/opentelemetry.exporter.instana
Range: < 1.1.0

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-wfr5-454p-mjc2ghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2026-44213ghsaADVISORY
github.com/open-telemetry/opentelemetry-dotnet-contrib/security/advisories/GHSA-wfr5-454p-mjc2nvdWEB

News mentions

OpenTelemetry: Five CVEs Across Go, Java, JS, and .NET SDKs Disclosed Together
Vypr Intelligence · May 28, 2026

cvss	0.423
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000