CVE-2026-109408 · Package
NO FIX YET · SEE WHAT TO DO
The Java client for HashiCorp Vault turns off TLS certificate and hostname verification when an SslConfig is built without build(), restored by Java deserialization, or set via VAULT_SSL_VERIFY to values such as 1, yes or on. An attacker on the network path to the Vault server can read the Vault token and secrets in transit and forge responses.
first public Nov 5, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Applications that use vault-java-driver versions 5.2.0 through 6.2.3 to talk to a Vault server over TLS. Exposure depends on how SslConfig is created: the flaw applies when build() is skipped, when the config is deserialized, or when VAULT_SSL_VERIFY holds a truthy value other than "true". Teams that verify with the default settings and use only the exact string "true" are not hit by the environment-variable or build() cases, and teams on 7.0.0 or later are not affected.
Not affected if default-config, version-7.0.0-or-later
Who cares hashicorp-vault, java, vault-java-driver
io.github.jopenlibs:vault-java-driver in the build file (pom.xml or build.gradle) and whether it falls in 5.2.0 through 6.2.3.VaultConfig with an SslConfig that skips build(), and for VAULT_SSL_VERIFY set to a value other than true.vault-java-driver, a Java client for HashiCorp Vault, silently disables TLS certificate and hostname verification in three states where the caller asked for verification: an SslConfig passed to VaultConfig without calling build(), an SslConfig restored by Java deserialization, and VAULT_SSL_VERIFY set to a truthy value other than "true", such as 1, yes or on. In each case SslConfig.isVerify() returns false and the driver installs a trust-all SSLContext. An attacker on the network path to the Vault server can then read the Vault token and secrets in transit and forge responses. This issue affects io.github.jopenlibs:vault-java-driver 5.2.0 through 6.2.3. It is fixed in 7.0.0.
This page as .md · .json · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
io.github.jopenlibs:vault-java-driver upgrade to 7.0.0