Advisory · CVE-2026-105216
go-micro ships with TLS certificate verification disabled
go-micro's shared TLS helper sets InsecureSkipVerify to true by default, letting network attackers impersonate services and intercept gRPC, HTTP, broker, and registry traffic including auth tokens.
- Vendor
- micro
- Product
- go-micro
- Identifier / CWE
- CVE-2026-105216
CWE-295 - Action timing
- Immediate
Explain it like I’m five
go-micro's TLS helper is like a bouncer who checks IDs but has been told to wave everyone through without looking. A network attacker can hold up any fake ID and read or rewrite traffic between your services, including login tokens, and nobody notices.
- 01Insecure default
The shared TLS helper sets InsecureSkipVerify to true by default in go-micro before 6.0.0.
- 02Attacker on the path
A network attacker positions themselves between services or between a service and its registry or broker.
- 03Any certificate accepted
The attacker presents any certificate; verification is skipped, so the connection is trusted.
- 04Traffic intercepted
The attacker intercepts or modifies gRPC transport, HTTP and RabbitMQ broker, and Consul or etcd registry traffic, including authentication tokens and credentials.
What happened
go-micro before 6.0.0 contains an improper certificate validation vulnerability: the shared TLS helper sets InsecureSkipVerify to true by default. Network attackers can impersonate services by presenting any certificate, intercepting or modifying gRPC transport, HTTP and RabbitMQ broker, and Consul or etcd registry traffic, including authentication tokens and credentials. It is rated critical at CVSS 9.1 under CVSS v4.0 (7.4 under v3.1) and tracked as CWE-295.
What to do
- Upgrade go-micro to 6.0.0 or later.
- Audit every service built on go-micro for TLS configuration overrides; remove any remaining
InsecureSkipVerify: trueoutside of local development. - Treat traffic between services as potentially intercepted: rotate service credentials, registry and broker credentials, and any tokens that crossed affected transports.
- Verify certificate validation is actually enforced after the upgrade, for example by testing with a self-signed certificate.
Management note
An insecure default in a shared library multiplies across every service built on it. This is not one misconfigured box; it is every go-micro service trusting any certificate on the wire. The upgrade is straightforward, but the credential rotation is the real work, because anything that crossed those connections should be considered seen.