Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
go-micro before 6.0.0 contains an improper certificate validation vulnerability that allows network attackers to impersonate services because the shared TLS helper sets InsecureSkipVerify to true by default. Man-in-the-middle attackers can present any certificate to intercept or modify gRPC transport, HTTP and RabbitMQ broker, and Consul or etcd registry traffic, including authentication tokens and credentials.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
go-micro's new CVE names a major-version upgrade as the only fix for TLS verification being off by default. The one-variable mitigation sits in the lines the record links to. No exploitation reported. https://severitydaily.com/go-micro-cve-2026-105216-insecureskipverify-default-only-fix-v6/