---
id: CVE-2026-109408
title: 'vault-java-driver: SslConfig silently disables requested TLS verification'
summary: >-
  vault-java-driver, a Java client for HashiCorp Vault, silently disables TLS
  certificate and hostname verification in three states where the caller asked
  for verification: an SslConfig passed to VaultConfig without calling build(),
  an Ssl…
severity: high
cvss: 7.4
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N'
cvssSource: cna
cwe:
  - CWE-636
  - CWE-295
  - CWE-297
vendor: jopenlibs
product: 'io.github.jopenlibs:vault-java-driver'
affected:
  - 'io.github.jopenlibs:vault-java-driver >= 5.2.0 < 7.0.0'
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-11-05T16:40:51.548101Z'
published: '2026-11-05'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T19:05:53.450Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-109408'
references:
  - url: 'https://github.com/jopenlibs/vault-java-driver/pull/78'
  - url: >-
      https://repo.maven.apache.org/maven2/io/github/jopenlibs/vault-java-driver/7.0.0/
tags:
  - cve.org
epss: 0.00177
epssPercentile: 0.07299
ingestedAt: '2026-11-05T22:38:31.503Z'
---

## Overview

vault-java-driver, a Java client for HashiCorp Vault, silently disables TLS certificate and hostname verification in three states where the caller asked for verification: an SslConfig passed to VaultConfig without calling build(), an SslConfig restored by Java deserialization, and VAULT_SSL_VERIFY set to a truthy value other than "true", such as 1, yes or on. In each case SslConfig.isVerify() returns false and the driver installs a trust-all SSLContext. An attacker on the network path to the Vault server can then read the Vault token and secrets in transit and forge responses. This issue affects io.github.jopenlibs:vault-java-driver 5.2.0 through 6.2.3. It is fixed in 7.0.0.

## Affected

- `io.github.jopenlibs:vault-java-driver >= 5.2.0 < 7.0.0`

## Remediation

Upgrade io.github.jopenlibs:vault-java-driver to 7.0.0 or later.