CVE-2026-26214

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-26214", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-02-11T20:08:07.943Z", "datePublished": "2026-02-12T15:01:15.687Z", "dateUpdated": "2026-07-14T15:53:59.739Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-07-14T15:53:59.739Z"}, "title": "Xiaomi Galaxy FDS Android SDK <= 3.0.8 TLS Hostname Verification Disabled Enables MITM", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Galaxy FDS Android SDK (XiaoMi/galaxy-fds-sdk-android) version 3.0.8 and prior disable TLS hostname verification when HTTPS is enabled (the default configuration). In GalaxyFDSClientImpl.createHttpClient(), the SDK configures Apache HttpClient with SSLSocketFactory.ALLOW_ALL_HOSTNAME_VERIFIER, which accepts any valid TLS certificate regardless of hostname mismatch. Because HTTPS is enabled by default in FDSClientConfiguration, all applications using the SDK with default settings are affected. This vulnerability allows a man-in-the-middle attacker to intercept and modify SDK communications to Xiaomi FDS cloud storage endpoints, potentially exposing authentication credentials, file contents, and API responses. The XiaoMi/galaxy-fds-sdk-android open source project has reached end-of-life status."}], "value": "Galaxy FDS Android SDK (XiaoMi/galaxy-fds-sdk-android) version 3.0.8 and prior disable TLS hostname verification when HTTPS is enabled (the default configuration). In GalaxyFDSClientImpl.createHttpClient(), the SDK configures Apache HttpClient with SSLSocketFactory.ALLOW_ALL_HOSTNAME_VERIFIER, which accepts any valid TLS certificate regardless of hostname mismatch. Because HTTPS is enabled by default in FDSClientConfiguration, all applications using the SDK with default settings are affected. This vulnerability allows a man-in-the-middle attacker to intercept and modify SDK communications to Xiaomi FDS cloud storage endpoints, potentially exposing authentication credentials, file contents, and API responses. The XiaoMi/galaxy-fds-sdk-android open source project has reached end-of-life status."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-297", "description": "CWE-297 Improper Validation of Certificate with Host Mismatch", "lang": "en", "type": "CWE"}]}], "affected": [{"defaultStatus": "unknown", "packageURL": "pkg:github/XiaoMi/galaxy-fds-sdk-android", "packageName": "galaxy-fds-sdk-android", "platforms": ["Android"], "product": "Galaxy FDS Android SDK", "repo": "https://github.com/XiaoMi/galaxy-fds-sdk-android", "vendor": "Xiaomi Technology Co., Ltd.", "versions": [{"lessThanOrEqual": "3.0.8", "status": "affected", "version": "0", "versionType": "semver"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 9.1, "baseSeverity": "CRITICAL", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "references": [{"tags": ["technical-description", "exploit"], "url": "https://github.com/XavLimSG/Vulnerability-Research/blob/main/CVE-2026-26214/CVE-2026-26214.md"}, {"tags": ["product"], "url": "https://github.com/XiaoMi/galaxy-fds-sdk-android"}, {"tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/xiaomi-galaxy-fds-android-sdk-tls-hostname-verification-disabled-enables-mitm"}], "credits": [{"lang": "en", "type": "finder", "value": "XavLimSG"}, {"lang": "en", "type": "coordinator", "value": "VulnCheck"}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "source": {"discovery": "EXTERNAL"}, "tags": ["unsupported-when-assigned"], "workarounds": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Remove line 134 (the ALLOW_ALL_HOSTNAME_VERIFIER assignment). The default SSLSocketFactory uses STRICT_HOSTNAME_VERIFIER, which is the correct secure behavior.<br>"}], "value": "Remove line 134 (the ALLOW_ALL_HOSTNAME_VERIFIER assignment). The default SSLSocketFactory uses STRICT_HOSTNAME_VERIFIER, which is the correct secure behavior."}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-03T21:02:00.361002Z", "id": "CVE-2026-26214", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-03T21:02:06.407Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-26214", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-03T21:02:00.361002Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-12T15:42:24.050Z"}}], "cna": {"tags": ["unsupported-when-assigned"], "title": "Xiaomi Galaxy FDS Android SDK <= 3.0.8 TLS Hostname Verification Disabled Enables MITM", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "XavLimSG"}, {"lang": "en", "type": "coordinator", "value": "VulnCheck"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/XiaoMi/galaxy-fds-sdk-android", "vendor": "Xiaomi Technology Co., Ltd.", "product": "Galaxy FDS Android SDK", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.0.8"}], "platforms": ["Android"], "packageURL": "pkg:github/XiaoMi/galaxy-fds-sdk-android", "packageName": "galaxy-fds-sdk-android", "defaultStatus": "unknown"}], "references": [{"url": "https://github.com/XavLimSG/Vulnerability-Research/blob/main/CVE-2026-26214/CVE-2026-26214.md", "tags": ["technical-description", "exploit"]}, {"url": "https://github.com/XiaoMi/galaxy-fds-sdk-android", "tags": ["product"]}, {"url": "https://www.vulncheck.com/advisories/xiaomi-galaxy-fds-android-sdk-tls-hostname-verification-disabled-enables-mitm", "tags": ["third-party-advisory"]}], "workarounds": [{"lang": "en", "value": "Remove line 134 (the ALLOW_ALL_HOSTNAME_VERIFIER assignment). The default SSLSocketFactory uses STRICT_HOSTNAME_VERIFIER, which is the correct secure behavior.", "supportingMedia": [{"type": "text/html", "value": "Remove line 134 (the ALLOW_ALL_HOSTNAME_VERIFIER assignment). The default SSLSocketFactory uses STRICT_HOSTNAME_VERIFIER, which is the correct secure behavior.<br>", "base64": false}]}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "Galaxy FDS Android SDK (XiaoMi/galaxy-fds-sdk-android) version 3.0.8 and prior disable TLS hostname verification when HTTPS is enabled (the default configuration). In GalaxyFDSClientImpl.createHttpClient(), the SDK configures Apache HttpClient with SSLSocketFactory.ALLOW_ALL_HOSTNAME_VERIFIER, which accepts any valid TLS certificate regardless of hostname mismatch. Because HTTPS is enabled by default in FDSClientConfiguration, all applications using the SDK with default settings are affected. This vulnerability allows a man-in-the-middle attacker to intercept and modify SDK communications to Xiaomi FDS cloud storage endpoints, potentially exposing authentication credentials, file contents, and API responses. The XiaoMi/galaxy-fds-sdk-android open source project has reached end-of-life status.", "supportingMedia": [{"type": "text/html", "value": "Galaxy FDS Android SDK (XiaoMi/galaxy-fds-sdk-android) version 3.0.8 and prior disable TLS hostname verification when HTTPS is enabled (the default configuration). In GalaxyFDSClientImpl.createHttpClient(), the SDK configures Apache HttpClient with SSLSocketFactory.ALLOW_ALL_HOSTNAME_VERIFIER, which accepts any valid TLS certificate regardless of hostname mismatch. Because HTTPS is enabled by default in FDSClientConfiguration, all applications using the SDK with default settings are affected. This vulnerability allows a man-in-the-middle attacker to intercept and modify SDK communications to Xiaomi FDS cloud storage endpoints, potentially exposing authentication credentials, file contents, and API responses. The XiaoMi/galaxy-fds-sdk-android open source project has reached end-of-life status.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-297", "description": "CWE-297 Improper Validation of Certificate with Host Mismatch"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-07-14T15:53:59.739Z"}}}, "cveMetadata": {"cveId": "CVE-2026-26214", "state": "PUBLISHED", "dateUpdated": "2026-07-14T15:53:59.739Z", "dateReserved": "2026-02-11T20:08:07.943Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-02-12T15:01:15.687Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "packageName": "galaxy-fds-sdk-android", "packageURL": "pkg:github/XiaoMi/galaxy-fds-sdk-android", "platforms": ["Android"], "product": "Galaxy FDS Android SDK", "repo": "https://github.com/XiaoMi/galaxy-fds-sdk-android", "vendor": "Xiaomi Technology Co., Ltd.", "versions": [{"lessThanOrEqual": "3.0.8", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [{"sourceIdentifier": "disclosure@vulncheck.com", "tags": ["unsupported-when-assigned"]}], "descriptions": [{"lang": "en", "value": "Galaxy FDS Android SDK (XiaoMi/galaxy-fds-sdk-android) version 3.0.8 and prior disable TLS hostname verification when HTTPS is enabled (the default configuration). In GalaxyFDSClientImpl.createHttpClient(), the SDK configures Apache HttpClient with SSLSocketFactory.ALLOW_ALL_HOSTNAME_VERIFIER, which accepts any valid TLS certificate regardless of hostname mismatch. Because HTTPS is enabled by default in FDSClientConfiguration, all applications using the SDK with default settings are affected. This vulnerability allows a man-in-the-middle attacker to intercept and modify SDK communications to Xiaomi FDS cloud storage endpoints, potentially exposing authentication credentials, file contents, and API responses. The XiaoMi/galaxy-fds-sdk-android open source project has reached end-of-life status."}, {"lang": "es", "value": "Galaxy FDS Android SDK (XiaoMi/galaxy-fds-sdk-android) versi\u00f3n 3.0.8 y anteriores deshabilitan la verificaci\u00f3n de nombre de host TLS cuando HTTPS est\u00e1 habilitado (la configuraci\u00f3n predeterminada). En GalaxyFDSClientImpl.createHttpClient(), el SDK configura Apache HttpClient con SSLSocketFactory.ALLOW_ALL_HOSTNAME_VERIFIER, que acepta cualquier certificado TLS v\u00e1lido independientemente de la falta de coincidencia del nombre de host. Debido a que HTTPS est\u00e1 habilitado por defecto en FDSClientConfiguration, todas las aplicaciones que usan el SDK con la configuraci\u00f3n predeterminada se ven afectadas. Esta vulnerabilidad permite a un atacante man-in-the-middle interceptar y modificar las comunicaciones del SDK a los puntos finales de almacenamiento en la nube de Xiaomi FDS, exponiendo potencialmente las credenciales de autenticaci\u00f3n, el contenido de los archivos y las respuestas de la API. El proyecto de c\u00f3digo abierto XiaoMi/galaxy-fds-sdk-android ha alcanzado el estado de fin de vida \u00fatil."}], "id": "CVE-2026-26214", "lastModified": "2026-07-14T16:16:58.317", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.2, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-26214", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-03T21:02:00.361002Z", "version": "2.0.3"}}]}, "published": "2026-02-12T16:16:17.183", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/XavLimSG/Vulnerability-Research/blob/main/CVE-2026-26214/CVE-2026-26214.md"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/XiaoMi/galaxy-fds-sdk-android"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/xiaomi-galaxy-fds-android-sdk-tls-hostname-verification-disabled-enables-mitm"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-297"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": ["android"], "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.0.8]"}}], "product": "galaxy_fds_android_sdk", "vendor": "xiaomi"}], "analysis": {"en": {"generated_at": "2026-04-16T17:12:19.172412+00:00", "value": {"mitigation_remediation": ["Upgrade the Galaxy FDS Android SDK to a version newer than 3.0.8, where hostname verification is enabled by default or corrects the SSLSocketFactory usage.", "As an interim measure, modify the SDK source by removing the line that assigns ALLOW_ALL_HOSTNAME_VERIFIER (line 134) so that the default STRICT_HOSTNAME_VERIFIER is used, ensuring TLS certificates are validated properly.", "If upgrading or modifying the source is not immediately feasible, configure each application to enforce hostname verification explicitly, for example by creating a custom SSLSocketFactory that rejects hostname mismatches or by pinning the server certificate."], "summary": {"action": "Patch/Workaround", "impact": "Remote Man\u2011in\u2011the\u2011Middle via TLS hostname verification bypass"}, "threat_synthesis": {"affected_systems": "Xiaomi Technology Co., Ltd. distributes the Galaxy FDS Android SDK. Versions up to and including 3.0.8, which are also in end\u2011of\u2011life status, configure Apache HttpClient with ALLOW_ALL_HOSTNAME_VERIFIER. All applications that integrate the SDK with its default HTTPS settings are thus affected.", "description_and_impact": "The Galaxy FDS Android SDK, when run with its default configuration, disables TLS hostname verification by using ALLOW_ALL_HOSTNAME_VERIFIER. This weakness allows an attacker on the same network to present any TLS certificate, causing the SDK to accept it even if the hostname does not match. The result is a man\u2011in\u2011the\u2011middle that can intercept, alter, or eavesdrop on all communications with Xiaomi FDS cloud storage, potentially leaking authentication credentials, file data, and API responses. This is a classic example of improper authentication enabled by weak TLS configuration (CWE\u2011297).", "risk_and_exploitability": "The CVSS score of 9.1 classifies this vulnerability as critical, and the EPSS score of less than 1% indicates that the exploitability probability is low, though not impossible. The vulnerability is not currently listed in the CISA KEV catalog. The likely attack vector is a network\u2011based MITM, where an adversary intercepts traffic between a client application and the FDS cloud endpoint. Exploitation requires the attacker to be able to serve a fraudulent TLS certificate; no additional system compromise is needed. The impact is remote, full\u2011scope compromise of data confidentiality and integrity for any application using the vulnerable SDK with default settings."}}}}, "created": "2026-02-13T21:35:33.170368+00:00", "updated": "2026-04-16T17:15:17.992876+00:00", "vendors": ["xiaomi", "xiaomi$PRODUCT$galaxy_fds_android_sdk"]}