Vulnerability · Published Oct 4, 2026 · Assigned by VulnCheck

CVE-2026-105216go-micro before 6.0.0 Disabled TLS Certificate Verification via tls.Config Helper

High 7.4

In plain English

A high-severity improper certificate validation in go-micro from micro. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities).

Severity (CVSS 3.1)7.4High

Exploit odds (30 days)0.2%top 90.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

go-micro before 6.0.0 contains an improper certificate validation vulnerability that allows network attackers to impersonate services because the shared TLS helper sets InsecureSkipVerify to true by default. Man-in-the-middle attackers can present any certificate to intercept or modify gRPC transport, HTTP and RabbitMQ broker, and Consul or etcd registry traffic, including authentication tokens and credentials.

Affected products (as reported)

Vendor	Product	Versions
micro	go-micro	0 – before 6.0.0

Weakness: CWE-295 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

References

GitHub Issue #2963 issue-tracking
https://github.com/micro/go-micro/commit/c7657f73f45cf839e643db10f28703eeab7299c3 patch
https://github.com/micro/go-micro/blob/v5.30.0/internal/util/tls/tls.go#L43-L67 technical-description
https://github.com/micro/go-micro product
VulnCheck Advisory: go-micro before 6.0.0 Disabled TLS Certificate Verification via tls.Config Helper third-party-advisory