Live › vulnerability › CVE-2026-106036
Szafir accepts any TLS certificate and skips hostname checks when it connects over HTTPS. An attacker on the network path can serve a fake server and make the application download a file the attacker chose, such as a malicious update.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:25 UTC. All times on this page are UTC.
Any machine running Szafir that downloads updates or other files over HTTPS is exposed, because the application does not check whether the server's certificate is genuine. The sources do not say which Szafir deployment modes or configurations are most exposed, and the risk depends on a network position that lets an attacker redirect the connection.
No product ranges from the sources yet.
2.0 build 708 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Szafir accepts any client or server certificate without performing certificate and hostname validation, allowing HTTPS connections without authenticating the remote server. An attacker can provide an arbitrary SSL/TLS certificate and cause the application to download an update file from their server.
This issue was fixed in version 2.0 build 708.
This page as .md · .json · in your agent: get_signal("CVE-2026-106036")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.