CVE-2026-109408

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-109408", "assignerOrgId": "abd028dc-c042-4c4d-9749-38d0f850af89", "state": "PUBLISHED", "assignerShortName": "Echo", "dateReserved": "2026-10-12T14:55:10.201Z", "datePublished": "2026-11-05T07:36:07.410Z", "dateUpdated": "2026-11-05T19:05:53.450Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "abd028dc-c042-4c4d-9749-38d0f850af89", "shortName": "Echo", "dateUpdated": "2026-11-05T07:36:07.410Z"}, "title": "vault-java-driver: SslConfig silently disables requested TLS verification", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-636", "description": "CWE-636 Not Failing Securely ('Failing Open')", "type": "CWE"}]}, {"descriptions": [{"lang": "en", "cweId": "CWE-295", "description": "CWE-295 Improper Certificate Validation", "type": "CWE"}]}, {"descriptions": [{"lang": "en", "cweId": "CWE-297", "description": "CWE-297 Improper Validation of Certificate with Host Mismatch", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-94", "descriptions": [{"lang": "en", "value": "CAPEC-94 Adversary in the Middle (AiTM)"}]}], "affected": [{"vendor": "jopenlibs", "product": "vault-java-driver", "collectionURL": "https://repo.maven.apache.org/maven2", "packageName": "io.github.jopenlibs:vault-java-driver", "repo": "https://github.com/jopenlibs/vault-java-driver", "programFiles": ["src/main/java/io/github/jopenlibs/vault/SslConfig.java", "src/main/java/io/github/jopenlibs/vault/rest/Rest.java"], "versions": [{"status": "affected", "version": "5.2.0", "lessThan": "7.0.0", "versionType": "maven"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "vault-java-driver, a Java client for HashiCorp Vault, silently disables TLS certificate and hostname verification in three states where the caller asked for verification: an SslConfig passed to VaultConfig without calling build(), an SslConfig restored by Java deserialization, and VAULT_SSL_VERIFY set to a truthy value other than \"true\", such as 1, yes or on. In each case SslConfig.isVerify() returns false and the driver installs a trust-all SSLContext. An attacker on the network path to the Vault server can then read the Vault token and secrets in transit and forge responses. This issue affects io.github.jopenlibs:vault-java-driver 5.2.0 through 6.2.3. It is fixed in 7.0.0.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>vault-java-driver, a Java client for HashiCorp Vault, silently disables TLS certificate and hostname verification in three states where the caller asked for verification: an SslConfig passed to VaultConfig without calling build(), an SslConfig restored by Java deserialization, and VAULT_SSL_VERIFY set to a truthy value other than \"true\", such as 1, yes or on. In each case SslConfig.isVerify() returns false and the driver installs a trust-all SSLContext. An attacker on the network path to the Vault server can then read the Vault token and secrets in transit and forge responses. This issue affects io.github.jopenlibs:vault-java-driver 5.2.0 through 6.2.3. It is fixed in 7.0.0.</p>"}]}], "references": [{"url": "https://github.com/jopenlibs/vault-java-driver/pull/78", "tags": ["patch"]}, {"url": "https://repo.maven.apache.org/maven2/io/github/jopenlibs/vault-java-driver/7.0.0/", "tags": ["patch"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "NONE", "baseSeverity": "HIGH", "baseScore": 7.4, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"}}], "solutions": [{"lang": "en", "value": "Upgrade io.github.jopenlibs:vault-java-driver to 7.0.0 or later.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Upgrade io.github.jopenlibs:vault-java-driver to 7.0.0 or later.<br></p>"}]}], "timeline": [{"time": "2026-10-05T14:00:00.000Z", "lang": "en", "value": "Reported to the maintainers"}, {"time": "2026-10-08T14:00:00.000Z", "lang": "en", "value": "Fix published as pull request #78"}], "credits": [{"lang": "en", "value": "Yuval Saggie and Mor Wienberger (powered by Echo Frontier)", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.5"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-05T16:40:51.548101Z", "id": "CVE-2026-109408", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T19:05:53.450Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-109408", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-11-05T16:40:51.548101Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T19:05:44.267Z"}}], "cna": {"title": "vault-java-driver: SslConfig silently disables requested TLS verification", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Yuval Saggie and Mor Wienberger (powered by Echo Frontier)"}], "impacts": [{"capecId": "CAPEC-94", "descriptions": [{"lang": "en", "value": "CAPEC-94 Adversary in the Middle (AiTM)"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/jopenlibs/vault-java-driver", "vendor": "jopenlibs", "product": "vault-java-driver", "versions": [{"status": "affected", "version": "5.2.0", "lessThan": "7.0.0", "versionType": "maven"}], "packageName": "io.github.jopenlibs:vault-java-driver", "programFiles": ["src/main/java/io/github/jopenlibs/vault/SslConfig.java", "src/main/java/io/github/jopenlibs/vault/rest/Rest.java"], "collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-10-05T14:00:00.000Z", "value": "Reported to the maintainers"}, {"lang": "en", "time": "2026-10-08T14:00:00.000Z", "value": "Fix published as pull request #78"}], "solutions": [{"lang": "en", "value": "Upgrade io.github.jopenlibs:vault-java-driver to 7.0.0 or later.", "supportingMedia": [{"type": "text/html", "value": "<p>Upgrade io.github.jopenlibs:vault-java-driver to 7.0.0 or later.<br></p>", "base64": false}]}], "references": [{"url": "https://github.com/jopenlibs/vault-java-driver/pull/78", "tags": ["patch"]}, {"url": "https://repo.maven.apache.org/maven2/io/github/jopenlibs/vault-java-driver/7.0.0/", "tags": ["patch"]}], "x_generator": {"engine": "Vulnogram 1.0.5"}, "descriptions": [{"lang": "en", "value": "vault-java-driver, a Java client for HashiCorp Vault, silently disables TLS certificate and hostname verification in three states where the caller asked for verification: an SslConfig passed to VaultConfig without calling build(), an SslConfig restored by Java deserialization, and VAULT_SSL_VERIFY set to a truthy value other than \"true\", such as 1, yes or on. In each case SslConfig.isVerify() returns false and the driver installs a trust-all SSLContext. An attacker on the network path to the Vault server can then read the Vault token and secrets in transit and forge responses. This issue affects io.github.jopenlibs:vault-java-driver 5.2.0 through 6.2.3. It is fixed in 7.0.0.", "supportingMedia": [{"type": "text/html", "value": "<p>vault-java-driver, a Java client for HashiCorp Vault, silently disables TLS certificate and hostname verification in three states where the caller asked for verification: an SslConfig passed to VaultConfig without calling build(), an SslConfig restored by Java deserialization, and VAULT_SSL_VERIFY set to a truthy value other than \"true\", such as 1, yes or on. In each case SslConfig.isVerify() returns false and the driver installs a trust-all SSLContext. An attacker on the network path to the Vault server can then read the Vault token and secrets in transit and forge responses. This issue affects io.github.jopenlibs:vault-java-driver 5.2.0 through 6.2.3. It is fixed in 7.0.0.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-636", "description": "CWE-636 Not Failing Securely ('Failing Open')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-295", "description": "CWE-295 Improper Certificate Validation"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-297", "description": "CWE-297 Improper Validation of Certificate with Host Mismatch"}]}], "providerMetadata": {"orgId": "abd028dc-c042-4c4d-9749-38d0f850af89", "shortName": "Echo", "dateUpdated": "2026-11-05T07:36:07.410Z"}}}, "cveMetadata": {"cveId": "CVE-2026-109408", "state": "PUBLISHED", "dateUpdated": "2026-11-05T19:05:53.450Z", "dateReserved": "2026-10-12T14:55:10.201Z", "assignerOrgId": "abd028dc-c042-4c4d-9749-38d0f850af89", "datePublished": "2026-11-05T07:36:07.410Z", "assignerShortName": "Echo"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected", "packageName": "io.github.jopenlibs:vault-java-driver", "product": "vault-java-driver", "programFiles": ["src/main/java/io/github/jopenlibs/vault/SslConfig.java", "src/main/java/io/github/jopenlibs/vault/rest/Rest.java"], "repo": "https://github.com/jopenlibs/vault-java-driver", "vendor": "jopenlibs", "versions": [{"lessThan": "7.0.0", "status": "affected", "version": "5.2.0", "versionType": "maven"}]}], "source": "abd028dc-c042-4c4d-9749-38d0f850af89"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "vault-java-driver, a Java client for HashiCorp Vault, silently disables TLS certificate and hostname verification in three states where the caller asked for verification: an SslConfig passed to VaultConfig without calling build(), an SslConfig restored by Java deserialization, and VAULT_SSL_VERIFY set to a truthy value other than \"true\", such as 1, yes or on. In each case SslConfig.isVerify() returns false and the driver installs a trust-all SSLContext. An attacker on the network path to the Vault server can then read the Vault token and secrets in transit and forge responses. This issue affects io.github.jopenlibs:vault-java-driver 5.2.0 through 6.2.3. It is fixed in 7.0.0."}], "id": "CVE-2026-109408", "lastModified": "2026-11-12T20:04:52.377", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.2, "source": "abd028dc-c042-4c4d-9749-38d0f850af89", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-109408", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-11-05T16:40:51.548101Z", "version": "2.0.3"}}]}, "published": "2026-11-05T08:17:03.463", "references": [{"source": "abd028dc-c042-4c4d-9749-38d0f850af89", "url": "https://github.com/jopenlibs/vault-java-driver/pull/78"}, {"source": "abd028dc-c042-4c4d-9749-38d0f850af89", "url": "https://repo.maven.apache.org/maven2/io/github/jopenlibs/vault-java-driver/7.0.0/"}], "sourceIdentifier": "abd028dc-c042-4c4d-9749-38d0f850af89", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-295"}, {"lang": "en", "value": "CWE-297"}, {"lang": "en", "value": "CWE-636"}], "source": "abd028dc-c042-4c4d-9749-38d0f850af89", "type": "Secondary"}]}

{"bugzilla": {"description": "io.github.jopenlibs/vault-java-driver: vault-java-driver: Information disclosure via improper TLS certificate verification", "id": "2567718", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567718"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.4", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "status": "draft"}, "cwe": "CWE-295", "details": ["vault-java-driver, a Java client for HashiCorp Vault, silently disables TLS certificate and hostname verification in three states where the caller asked for verification: an SslConfig passed to VaultConfig without calling build(), an SslConfig restored by Java deserialization, and VAULT_SSL_VERIFY set to a truthy value other than \"true\", such as 1, yes or on. In each case SslConfig.isVerify() returns false and the driver installs a trust-all SSLContext. An attacker on the network path to the Vault server can then read the Vault token and secrets in transit and forge responses. This issue affects io.github.jopenlibs:vault-java-driver 5.2.0 through 6.2.3. It is fixed in 7.0.0.", "A flaw was found in vault-java-driver. Under certain configuration conditions, the driver fails to properly enforce Transport Layer Security (TLS) certificate and hostname verification even when verification has been requested. An attacker positioned on the network path between the client and the server can exploit this issue to intercept communication, leading to information disclosure of sensitive authentication tokens and secrets, or the forgery of server responses."], "mitigation": {"lang": "en:us", "value": "Configure the client environment to explicitly enforce TLS verification using the canonical string value:\n1. Set the environment variable strictly to the literal string \"true\":\n```bash\nexport VAULT_SSL_VERIFY=\"true\"\n```\n2. In systemd service unit files or container definitions, ensure `VAULT_SSL_VERIFY=true` is defined instead of alternative truthy values such as `1`, `yes`, or `on`.\n3. Restrict and isolate network communication between client workloads and the HashiCorp Vault service to trusted subnets, private container networks, or encrypted transport tunnels (such as IPsec) to prevent on-path traffic interception.\nWarning: Applying environment variable or service configuration changes requires restarting the affected application service to take effect."}, "name": "CVE-2026-109408", "public_date": "2026-11-05T07:36:07Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-109408\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-109408\nhttps://github.com/jopenlibs/vault-java-driver/pull/78\nhttps://repo.maven.apache.org/maven2/io/github/jopenlibs/vault-java-driver/7.0.0/"], "statement": "Red Hat has evaluated this vulnerability as having an Important severity impact because an unintended failure to validate TLS certificates allows an attacker with network-level access to intercept sensitive authentication tokens and confidential credentials. This risk is rated Important rather than Critical or Moderate because exploitation requires the adversary to occupy an on-path position between the client service and HashiCorp Vault. In typical Red Hat enterprise environments, applications utilizing this driver within secured private networks or container meshes face reduced risk, though exposure increases if traffic traverses unsegmented or public infrastructure.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.2.0,7.0.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "vault-java-driver", "source": "cna", "vendor": "jopenlibs"}, "product": "vault-java-driver", "vendor": "jopenlibs"}], "created": "2026-11-05T08:30:14.305240+00:00", "updated": "2026-11-06T21:15:16.683506+00:00", "vendors": ["jopenlibs", "jopenlibs$PRODUCT$vault-java-driver"]}