by Kastro
Paper/Archive/CVE-2026-105216

CVE-2026-105216

micro go-micro — go-micro before 6.0.0 Disabled TLS Certificate Verification via tls.Config Helper

EPSS 0.2%CVSS 9.1
critical.is priorityof 100
29
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 9.1.091 × 201.8No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

go-micro before 6.0.0 contains an improper certificate validation vulnerability that allows network attackers to impersonate services because the shared TLS helper sets InsecureSkipVerify to true by default. Man-in-the-middle attackers can present any certificate to intercept or modify gRPC transport, HTTP and RabbitMQ broker, and Consul or etcd registry traffic, including authentication tokens and credentials.

Affected

ProductAffectedFixed inSource
go-micro< 6.0.06.0.0CNA

Scores by source

VulnCheck (CNA)9.1CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
VulnCheck (CNA)7.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

refgithub.com/micro/go-micro/issues/2963patchgithub.com/micro/go-micro/commit/c7657f73f45cf839e643db10f28703eeab7299c3writeupgithub.com/micro/go-micro/blob/v5.30.0/internal/util/tls/tls.go#L43-L67refgithub.com/micro/go-microwriteupvulncheck.com/advisories/go-micro-before-6.0.0-disabled-tls-certificate-verification-via-tls-config-helper