CVE-2026-105216 — go-micro before 6.0.0 Disabled TLS Certificate Verification via tls.Config Helper
go-micro before 6.0.0 contains an improper certificate validation vulnerability that allows network attackers to impersonate services because the shared TLS helper sets Insecure…
Published: 2026-10-04 · CVSS: 9.1 · CVSS 4.0
go-micro before 6.0.0 contains an improper certificate validation vulnerability that allows network attackers to impersonate services because the shared TLS helper sets InsecureSkipVerify to true by default. Man-in-the-middle attackers can present any certificate to intercept or modify gRPC transport, HTTP and RabbitMQ broker, and Consul or etcd registry traffic, including authentication tokens and credentials.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7