{"id":"CVE-2026-106036","kind":"vulnerability","aliases":["CVE-2026-106036"],"related":[],"title":"Szafir: missing certificate checks let attackers serve fake update files","description":"Szafir accepts any client or server certificate without performing certificate and hostname validation, allowing HTTPS connections without authenticating the remote server. An attacker can provide an arbitrary SSL/TLS certificate and cause the application to download an update file from their server.\n\n\n\nThis issue was fixed in version 2.0 build 708.","summary":"Szafir accepts any TLS certificate and skips hostname checks when it connects over HTTPS. An attacker on the network path can serve a fake server and make the application download a file the attacker chose, such as a malicious update.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["other","self-hosted","szafir","windows"],"not_affected_if":["already-on-2.0-build-708"],"how_to_check":"- Look for the Szafir application installed on the machine and read its version in the application's About dialog or package metadata (unknown whether the sources give an exact path).\n- Compare the installed version against the fixed version below.","fix":"- Szafir: move to `2.0` build `708` or later.","status":"open","published_at":"2026-10-29T16:17:47+00:00","first_seen_at":"2026-10-29T16:25:55+00:00","triaged_at":"2026-10-29T16:30:12+00:00","updated_at":"2026-10-29T16:30:12+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-29T16:30:12Z","model":"claude-haiku-5-5","output":{"fix":"- Szafir: move to `2.0` build `708` or later.","reach":"network","title":"Szafir: missing certificate checks let attackers serve fake update files","impact":"high","summary":"Szafir accepts any TLS certificate and skips hostname checks when it connects over HTTPS. An attacker on the network path can serve a fake server and make the application download a file the attacker chose, such as a malicious update.","audience":"businesses","category":"other","nicknames":[],"who_cares":["szafir","windows","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"attacker supplies a malicious update file the application installs","analyst_note":"","how_to_check":"- Look for the Szafir application installed on the machine and read its version in the application's About dialog or package metadata (unknown whether the sources give an exact path).\n- Compare the installed version against the fixed version below.","plain_action":"","needs_analyst":false,"not_affected_if":["already-on-2.0-build-708"],"who_is_affected":"Any machine running Szafir that downloads updates or other files over HTTPS is exposed, because the application does not check whether the server's certificate is genuine. The sources do not say which Szafir deployment modes or configurations are most exposed, and the risk depends on a network position that lets an attacker redirect the connection.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000661,"input_tokens":4122,"output_tokens":498,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-106036':13A,16A '-2026':12A,15A '2.0':110C '708':112C 'accept':24B,64C 'allow':76C 'applic':51B,95C 'arbitrari':89C 'attack':6A,38B,56B,85C 'authent':80C 'build':111C 'caus':93C 'certif':3A,27B,69C,72C,91C 'check':4A,31B 'chose':57B 'client':66C 'connect':34B,78C 'cve':11A,14A 'download':52B,97C 'fake':8A,46B 'file':10A,54B,100C 'fix':107C 'host':20B 'hostnam':30B,74C 'https':36B,77C 'issu':105C 'let':5A 'make':49B 'malici':61B 'miss':2A 'network':41B 'path':42B 'perform':71C 'provid':87C 'remot':82C 'self':19B 'self-host':18B 'serv':7A,44B 'server':47B,68C,83C,103C 'skip':29B 'ssl/tls':90C 'szafir':1A,21B,23B,63C 'tls':26B 'updat':9A,62B,99C 'valid':75C 'version':109C 'window':22B 'without':70C,79C","nicknames":[],"mitigations":[],"who_affected":"Any machine running Szafir that downloads updates or other files over HTTPS is exposed, because the application does not check whether the server's certificate is genuine. The sources do not say which Szafir deployment modes or configurations are most exposed, and the risk depends on a network position that lets an attacker redirect the connection.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T16:17:47+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cvd@cert.pl","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-106036","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106036","severity":null,"published_at":"2026-10-29T16:17:47+00:00","modified_at":"2026-10-29T16:17:47+00:00","first_seen_at":"2026-10-29T16:25:55+00:00","fetched_at":"2026-10-29T16:25:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}