---
id: "CVE-2026-106036"
kind: "vulnerability"
aliases: ["CVE-2026-106036"]
title: "Szafir: missing certificate checks let attackers serve fake update files"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["other", "self-hosted", "szafir", "windows"]
not_affected_if: ["already-on-2.0-build-708"]
published_at: "2026-10-29T16:17:47+00:00"
first_seen_at: "2026-10-29T16:25:55+00:00"
updated_at: "2026-10-29T16:30:12+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106036", "first_seen_at": "2026-10-29T16:25:55+00:00"}]
---

# Szafir: missing certificate checks let attackers serve fake update files

Szafir accepts any TLS certificate and skips hostname checks when it connects over HTTPS. An attacker on the network path can serve a fake server and make the application download a file the attacker chose, such as a malicious update.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Look for the Szafir application installed on the machine and read its version in the application's About dialog or package metadata (unknown whether the sources give an exact path).
- Compare the installed version against the fixed version below.

## Fix

- Szafir: move to `2.0` build `708` or later.

## Timeline

- 2026-10-29T16:25:55+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-106036

## From the sources

Szafir accepts any client or server certificate without performing certificate and hostname validation, allowing HTTPS connections without authenticating the remote server. An attacker can provide an arbitrary SSL/TLS certificate and cause the application to download an update file from their server.



This issue was fixed in version 2.0 build 708.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_