CVE-2026-105216

High

Description

go-micro before 6.0.0 contains an improper certificate validation vulnerability that allows network attackers to impersonate services because the shared TLS helper sets InsecureSkipVerify to true by default. Man-in-the-middle attackers can present any certificate to intercept or modify gRPC transport, HTTP and RabbitMQ broker, and Consul or etcd registry traffic, including authentication tokens and credentials.

SeverityHigh

CVSS7.4

Exploit probability—

ProductGo-micro

PublishedOct 4, 2026

First seenOct 4, 2026

Weakness typeCWE-295CWE-295

How to fix

Update

micro go-micro6.0.0 or later

Patches

github.com/micro/go-micro/commit/c7657f73f45cf839e643db10f28703eeab7299c3

Affected products

Product	Affected versions	Fixed in
micro go-micro	v < 6.0.0	6.0.0

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.