Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.1

go-micro before 6.0 lets attackers spoof services

CVE-2026-105216 · published 14 days ago
Summary

Versions of go-micro earlier than 6.0 do not properly check TLS certificates, so a network attacker can pretend to be a legitimate service. This can let the attacker read or change data sent between services, including login tokens. Update to version 6.0 or later, or configure the software to verify certificates correctly.

What to do
  • Update micro go-micro to version 6.0.0 or later.
Affected software
VendorProductAffected versions
micro go-micro < 6.0.0
Original advisory text
go-micro before 6.0.0 Disabled TLS Certificate Verification via tls.Config Helper
go-micro before 6.0.0 contains an improper certificate validation vulnerability that allows network attackers to impersonate services because the shared TLS helper sets InsecureSkipVerify to true by default. Man-in-the-middle attackers can present any certificate to intercept or modify gRPC transport, HTTP and RabbitMQ broker, and Consul or etcd registry traffic, including authentication tokens and credentials.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
9.1 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-295Improper Certificate Validation
Timeline
Published4 Oct 2026
Updated14 Oct 2026
First seen4 Oct 2026
Sources
CVE-2026-105216 · NVD
CVE-2026-105216 · MITRE
CVE-2026-105216 · OSV
Track software like this
Free during beta