TI-2026-82214 CVE-2026-118682 · GHSA-wvpm-52pr-rww8
Disabled TLS certificate validation in KaringX ClashMi enables update MITM
Priority HIGH 69
KaringX ClashMi through 1.0.32.1801 disables TLS certificate validation by default in the HttpUtils helper, allowing attackers to intercept HTTPS traffic by presenting any certificate.