CVE-2026-25060
TLS Certificate Verification Bypass in OpenList Frontend Enables MitM
Publication date: 2026-02-02
Last updated on: 2026-02-23
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| oplist | openlist | to 4.1.10 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-599 | The product uses OpenSSL and trusts or uses a certificate without using the SSL_get_verify_result() function to ensure that the certificate satisfies all necessary security requirements. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in OpenList Frontend versions prior to 4.1.10, where TLS certificate verification is disabled by default for all storage driver communications. Because the TlsInsecureSkipVerify setting is true by default, the system does not verify the authenticity of TLS certificates, allowing attackers to perform Man-in-the-Middle (MitM) attacks. Attackers can intercept and manipulate storage communications by redirecting traffic through methods like ARP spoofing, rogue Wi-Fi access points, or compromised network equipment. This enables attackers to decrypt, steal, and alter data without triggering security warnings.
How can this vulnerability impact me? :
This vulnerability can lead to severe security impacts including data theft, data manipulation, and unauthorized access to sensitive storage communications. Attackers can intercept encrypted traffic, decrypt it, and alter storage operations, potentially compromising the integrity, confidentiality, and availability of your data and systems.
What immediate steps should I take to mitigate this vulnerability?
Upgrade OpenList Frontend to version 4.1.10 or later, where the TLS certificate verification is enabled by default, fixing the vulnerability. Until the upgrade, avoid using versions prior to 4.1.10 in environments where network-level attacks like ARP spoofing or rogue Wi-Fi access points are possible.