Go Micro Before 6.0.0 Disabled Tls Certificate Verification Via Tls Config Helper

Back www.vulncheck.com

Go Micro Before 6.0.0 Disabled Tls Certificate Verification Via Tls Config Helper

www.vulncheck.com • October 4, 2026

Share: View original

go-micro before 6.0.0 Disabled TLS Certificate Verification via tls.Config Helper

go-micro >= 0, = 0, < 6.0.0

CWE-295 Improper Certificate Validation

Ready to get Started?

Vulnerability Prioritization Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.

Early Warning System Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Go Micro Framework Exposes Services to MITM Attacks Due to Insecure TLS Config The go-micro framework, prior to version 6.0.0, has a default TLS configuration that disables certificate verification for gRPC and HTTP communications, making it vulnerable to man-in-the-middle (MITM) attacks. This issue is acknowledged in the code with a SECURITY WARNING and DEPRECATION NOTICE, but the default setting remains unchanged for backward compatibility. Services using go-micro without explicitly setting the MICRO_TLS_SECURE=true option will transmit data over unverified TLS, allowing network-adjacent attackers to intercept and modify service-to-service traffic. The recommended actions are to change the default configuration or invert the opt-in requirement to enhance security. A full technical report is available upon request. 51

Extracted Entities

CWE Weaknesses (1)

CWE-295 - Improper Certificate Validation

Platforms (1)