Read the docs
TI-2026-85379 Aliases CVE-2026-109408GHSA-4frw-2vwq-957r

vault-java-driver silently disables requested TLS verification

Priority LOW 34CWE-295Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Spoofing
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-295.

Summary

The io.github.jopenlibs:vault-java-driver package from 5.2.0 before 7.0.0 is affected. In three configuration states, including an SslConfig passed to VaultConfig without calling build(), the driver silently disables TLS certificate and hostname verification and installs a trust-all SSLContext (CWE-295). An attacker on the network path to the Vault server can read the Vault token and secrets in transit and forge responses.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

vault-java-driver, a Java client for HashiCorp Vault, silently disables TLS certificate and hostname verification in three states where the caller asked for verification: an SslConfig passed to VaultConfig without calling build(), an SslConfig restored by Java deserialization, and VAULT_SSL_VERIFY set to a truthy value other than "true", such as 1, yes or on. In each case SslConfig.isVerify() returns false and the driver installs a trust-all SSLContext. An attacker on the network path to the Vault server can then read the Vault token and secrets in transit and forge responses. This issue affects io.github.jopenlibs:vault-java-driver 5.2.0 through 6.2.3. It is fixed in 7.0.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00177 7th percentileScored 2026-11-07
Fix Fixed vault-java-driver (jopenlibs): 7.0.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
jopenlibsvault-java-driver5.2.0 to before 7.0.07.0.0Patch availableCNA
  • vault-java-driver Vendorjopenlibs Affected 5.2.0 to before 7.0.0 Fixed in 7.0.0 Patch available CNA

Remediation

Upgrade vault-java-driver to version 7.0.0, which is the fixed version.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA vault-java-driver (jopenlibs) Fixed in 7.0.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    jopenlibs vault-java-driver 7.0.0

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2026-85380 Deeply nested JSON in vault-java-driver crashes threads that read itPriority LOW 29
    Show all 2 records →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-11-05 Threatist record created from CVE-2026-109408
  2. 2026-11-05 Alias added: GHSA-4frw-2vwq-957r
  3. 2026-11-05 CISA SSVC decision points changed
  4. 2026-11-05 Priority changed: MEDIUM → LOW
  5. 2026-11-06 Affected versions changed · Red Hat
  6. 2026-11-06 CVSS score added · Red Hat

References

Patch 2

  • TI-2026-85380 Deeply nested JSON in vault-java-driver crashes threads that read it CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences