CVE-2026-109408

    Dashboard / Vulnerabilities / CVE-2026-109408

    CVE-2026-109408

    Published: 5 Nov 2026Last Modified: 7 Nov 2026

    Summary: vault-java-driver: SslConfig silently disables requested TLS verification

    Details: vault-java-driver, a Java client for HashiCorp Vault, silently disables TLS certificate and hostname verification in three states where the caller asked for verification: an SslConfig passed to VaultConfig without calling build(), an SslConfig restored by Java deserialization, and VAULT_SSL_VERIFY set to a truthy value other than "true", such as 1, yes or on. In each case SslConfig.isVerify() returns false and the driver installs a trust-all SSLContext. An attacker on the network path to the Vault server can then read the Vault token and secrets in transit and forge responses. This issue affects io.github.jopenlibs:vault-java-driver 5.2.0 through 6.2.3. It is fixed in 7.0.0.

    References: https://repo.maven.apache.org/maven2, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/109xxx/CVE-2026-109408.json, https://nvd.nist.gov/vuln/detail/CVE-2026-109408, https://github.com/jopenlibs/vault-java-driver/pull/78, https://repo.maven.apache.org/maven2/io/github/jopenlibs/vault-java-driver/7.0.0/, https://github.com/jopenlibs/vault-java-driver

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- ff8b2d08adf8643dfb751ae04934e230a98172ea
    Fixed -None

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-109408 | CVE-DB