{"id":"CVE-2026-109408","title":"vault-java-driver: SslConfig silently disables requested TLS verification","summary":"vault-java-driver, a Java client for HashiCorp Vault, silently disables TLS certificate and hostname verification in three states where the caller asked for verification: an SslConfig passed to VaultConfig without calling build(), an Ssl…","severity":"high","cvss":7.4,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","cvssSource":"cna","cwe":["CWE-636","CWE-295","CWE-297"],"vendor":"jopenlibs","product":"io.github.jopenlibs:vault-java-driver","affected":["io.github.jopenlibs:vault-java-driver >= 5.2.0 < 7.0.0"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-11-05T16:40:51.548101Z"},"published":"2026-11-05","updated":"2026-11-05","sourceUpdated":"2026-11-05T19:05:53.450Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-109408","references":[{"url":"https://github.com/jopenlibs/vault-java-driver/pull/78"},{"url":"https://repo.maven.apache.org/maven2/io/github/jopenlibs/vault-java-driver/7.0.0/"}],"tags":["cve.org"],"epss":0.00177,"epssPercentile":0.07299,"ingestedAt":"2026-11-05T22:38:31.503Z","slug":"CVE-2026-109408","body":"## Overview\n\nvault-java-driver, a Java client for HashiCorp Vault, silently disables TLS certificate and hostname verification in three states where the caller asked for verification: an SslConfig passed to VaultConfig without calling build(), an SslConfig restored by Java deserialization, and VAULT_SSL_VERIFY set to a truthy value other than \"true\", such as 1, yes or on. In each case SslConfig.isVerify() returns false and the driver installs a trust-all SSLContext. An attacker on the network path to the Vault server can then read the Vault token and secrets in transit and forge responses. This issue affects io.github.jopenlibs:vault-java-driver 5.2.0 through 6.2.3. It is fixed in 7.0.0.\n\n## Affected\n\n- `io.github.jopenlibs:vault-java-driver >= 5.2.0 < 7.0.0`\n\n## Remediation\n\nUpgrade io.github.jopenlibs:vault-java-driver to 7.0.0 or later.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":40.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}