CVE-2026-105216

HIGH

go-micro before 6.0.0 contains an improper certificate validation vulnerability that allows network attackers to impersonate services because the shared TLS helper sets InsecureSkipVerify to true by default. Man-in-the-middle attackers can present any certificate to intercept or modify gRPC transport, HTTP and RabbitMQ broker, and Consul or etcd registry traffic, including authentication tokens and credentials.

CVSS v3.1 Score

7.4
HIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack Vector
NETWORK
Complexity
HIGH
Privileges
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
NONE
Published: 10/4/2026Modified: 10/6/2026

Related Intelligence (1)

HIGHVulnerability

NVD HIGH: CVE-2026-105216 — go-micro before 6.0.0 contains an improper certificate validation vulnerability ...

go-micro before 6.0.0 contains an improper certificate validation vulnerability that allows network attackers to impersonate services because the shared TLS helper sets InsecureSkipVerify to true by default. Man-in-the-middle attackers can present any certificate to intercept or modify gRPC transport, HTTP and RabbitMQ broker, and Consul or etcd registry traffic, including authentication tokens an

CVE-2026-105216
NIST NVD

References (5)

https://github.com/micro/go-microhttps://github.com/micro/go-micro/blob/v5.30.0/internal/util/tls/tls.go#L43-L67https://github.com/micro/go-micro/commit/c7657f73f45cf839e643db10f28703eeab7299c3https://github.com/micro/go-micro/issues/2963https://www.vulncheck.com/advisories/go-micro-before-6.0.0-disabled-tls-certificate-verification-via-tls-config-helper