{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-109408", "assignerOrgId": "abd028dc-c042-4c4d-9749-38d0f850af89", "state": "PUBLISHED", "assignerShortName": "Echo", "dateReserved": "2026-10-12T14:55:10.201Z", "datePublished": "2026-11-05T07:36:07.410Z", "dateUpdated": "2026-11-05T07:36:07.410Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "abd028dc-c042-4c4d-9749-38d0f850af89", "shortName": "Echo", "dateUpdated": "2026-11-05T07:36:07.410Z"}, "title": "vault-java-driver: SslConfig silently disables requested TLS verification", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-636", "description": "CWE-636 Not Failing Securely ('Failing Open')", "type": "CWE"}]}, {"descriptions": [{"lang": "en", "cweId": "CWE-295", "description": "CWE-295 Improper Certificate Validation", "type": "CWE"}]}, {"descriptions": [{"lang": "en", "cweId": "CWE-297", "description": "CWE-297 Improper Validation of Certificate with Host Mismatch", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-94", "descriptions": [{"lang": "en", "value": "CAPEC-94 Adversary in the Middle (AiTM)"}]}], "affected": [{"vendor": "jopenlibs", "product": "vault-java-driver", "collectionURL": "https://repo.maven.apache.org/maven2", "packageName": "io.github.jopenlibs:vault-java-driver", "repo": "https://github.com/jopenlibs/vault-java-driver", "programFiles": ["src/main/java/io/github/jopenlibs/vault/SslConfig.java", "src/main/java/io/github/jopenlibs/vault/rest/Rest.java"], "versions": [{"status": "affected", "version": "5.2.0", "lessThan": "7.0.0", "versionType": "maven"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "vault-java-driver, a Java client for HashiCorp Vault, silently disables TLS certificate and hostname verification in three states where the caller asked for verification: an SslConfig passed to VaultConfig without calling build(), an SslConfig restored by Java deserialization, and VAULT_SSL_VERIFY set to a truthy value other than \"true\", such as 1, yes or on. In each case SslConfig.isVerify() returns false and the driver installs a trust-all SSLContext. An attacker on the network path to the Vault server can then read the Vault token and secrets in transit and forge responses. This issue affects io.github.jopenlibs:vault-java-driver 5.2.0 through 6.2.3. It is fixed in 7.0.0.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>vault-java-driver, a Java client for HashiCorp Vault, silently disables TLS certificate and hostname verification in three states where the caller asked for verification: an SslConfig passed to VaultConfig without calling build(), an SslConfig restored by Java deserialization, and VAULT_SSL_VERIFY set to a truthy value other than \"true\", such as 1, yes or on. In each case SslConfig.isVerify() returns false and the driver installs a trust-all SSLContext. An attacker on the network path to the Vault server can then read the Vault token and secrets in transit and forge responses. This issue affects io.github.jopenlibs:vault-java-driver 5.2.0 through 6.2.3. It is fixed in 7.0.0.</p>"}]}], "references": [{"url": "https://github.com/jopenlibs/vault-java-driver/pull/78", "tags": ["patch"]}, {"url": "https://repo.maven.apache.org/maven2/io/github/jopenlibs/vault-java-driver/7.0.0/", "tags": ["patch"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "NONE", "baseSeverity": "HIGH", "baseScore": 7.4, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"}}], "solutions": [{"lang": "en", "value": "Upgrade io.github.jopenlibs:vault-java-driver to 7.0.0 or later.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Upgrade io.github.jopenlibs:vault-java-driver to 7.0.0 or later.<br></p>"}]}], "timeline": [{"time": "2026-10-05T14:00:00.000Z", "lang": "en", "value": "Reported to the maintainers"}, {"time": "2026-10-08T14:00:00.000Z", "lang": "en", "value": "Fix published as pull request #78"}], "credits": [{"lang": "en", "value": "Yuval Saggie and Mor Wienberger (powered by Echo Frontier)", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.5"}}}}

{}

{}

{}

{}