{"id":"CVE-2026-109408","kind":"vulnerability","aliases":["CVE-2026-109408"],"related":[],"title":"vault-java-driver: TLS certificate and hostname checks silently disabled in three cases","description":"vault-java-driver, a Java client for HashiCorp Vault, silently disables TLS certificate and hostname verification in three states where the caller asked for verification: an SslConfig passed to VaultConfig without calling build(), an SslConfig restored by Java deserialization, and VAULT_SSL_VERIFY set to a truthy value other than \"true\", such as 1, yes or on. In each case SslConfig.isVerify() returns false and the driver installs a trust-all SSLContext. An attacker on the network path to the Vault server can then read the Vault token and secrets in transit and forge responses. This issue affects io.github.jopenlibs:vault-java-driver 5.2.0 through 6.2.3. It is fixed in 7.0.0.","summary":"The Java client for HashiCorp Vault turns off TLS certificate and hostname verification when an SslConfig is built without build(), restored by Java deserialization, or set via VAULT_SSL_VERIFY to values such as 1, yes or on. An attacker on the network path to the Vault server can read the Vault token and secrets in transit and forge responses.","severity":"high","cvss":7.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["hashicorp-vault","java","package","vault-java-driver"],"not_affected_if":["default-config","version-7.0.0-or-later"],"how_to_check":"- Check the version of `io.github.jopenlibs:vault-java-driver` in the build file (pom.xml or build.gradle) and whether it falls in 5.2.0 through 6.2.3.\n- Search the code for `VaultConfig` with an `SslConfig` that skips `build()`, and for `VAULT_SSL_VERIFY` set to a value other than `true`.","fix":"- `io.github.jopenlibs:vault-java-driver` upgrade to `7.0.0`","status":"open","published_at":"2026-11-05T08:17:03+00:00","first_seen_at":"2026-11-05T08:38:02+00:00","triaged_at":"2026-11-05T08:39:50+00:00","updated_at":"2026-11-05T08:39:50+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-05T08:39:50Z","model":"claude-haiku-5-5","output":{"fix":"- `io.github.jopenlibs:vault-java-driver` upgrade to `7.0.0`","reach":"network","title":"vault-java-driver: TLS certificate and hostname checks silently disabled in three cases","impact":"high","summary":"The Java client for HashiCorp Vault turns off TLS certificate and hostname verification when an SslConfig is built without build(), restored by Java deserialization, or set via VAULT_SSL_VERIFY to values such as 1, yes or on. An attacker on the network path to the Vault server can read the Vault token and secrets in transit and forge responses.","audience":"developers","category":"package","nicknames":[],"who_cares":["java","hashicorp-vault","vault-java-driver"],"confidence":0.8,"fix_status":"available","needs_auth":"unknown","worst_case":"Vault token and secrets readable in transit; server responses forged.","analyst_note":"","how_to_check":"- Check the version of `io.github.jopenlibs:vault-java-driver` in the build file (pom.xml or build.gradle) and whether it falls in 5.2.0 through 6.2.3.\n- Search the code for `VaultConfig` with an `SslConfig` that skips `build()`, and for `VAULT_SSL_VERIFY` set to a value other than `true`.","plain_action":"","needs_analyst":false,"not_affected_if":["version-7.0.0-or-later","default-config"],"who_is_affected":"Applications that use vault-java-driver versions 5.2.0 through 6.2.3 to talk to a Vault server over TLS. Exposure depends on how SslConfig is created: the flaw applies when build() is skipped, when the config is deserialized, or when VAULT_SSL_VERIFY holds a truthy value other than \"true\". Teams that verify with the default settings and use only the exact string \"true\" are not hit by the environment-variable or build() cases, and teams on 7.0.0 or later are not affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.00079,"input_tokens":4374,"output_tokens":706,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-109408':17A,20A '-2026':16A,19A '1':64B,144C '5.2.0':194C '6.2.3':196C '7.0.0':201C 'affect':188C 'ask':113C 'attack':69B,164C 'build':49B,123C 'built':47B 'call':122C 'caller':112C 'case':14A,150C 'certif':6A,39B,103C 'check':9A 'client':32B,96C 'cve':15A,18A 'deseri':53B,129C 'disabl':11A,101C 'driver':4A,29B,93C,156C,193C 'fals':153C 'fix':199C 'forg':88B,184C 'hashicorp':22B,34B,98C 'hashicorp-vault':21B 'hostnam':8A,41B,105C 'instal':157C 'io.github.jopenlibs':189C 'issu':187C 'java':3A,24B,28B,31B,52B,92C,95C,128C,192C 'network':72B,167C 'packag':25B 'pass':118C 'path':73B,168C 'read':79B,175C 'respons':89B,185C 'restor':50B,126C 'return':152C 'secret':84B,180C 'server':77B,172C 'set':55B,134C 'silent':10A,100C 'ssl':58B,132C 'sslconfig':45B,117C,125C 'sslconfig.isverify':151C 'sslcontext':162C 'state':109C 'three':13A,108C 'tls':5A,38B,102C 'token':82B,178C 'transit':86B,182C 'true':141C 'trust':160C 'trust-al':159C 'truthi':137C 'turn':36B 'valu':61B,138C 'vault':2A,23B,27B,35B,57B,76B,81B,91C,99C,131C,171C,177C,191C 'vault-java-driv':1A,26B,90C,190C 'vaultconfig':120C 'verif':42B,106C,115C 'verifi':59B,133C 'via':56B 'without':48B,121C 'yes':65B,145C","nicknames":[],"mitigations":[],"who_affected":"Applications that use vault-java-driver versions 5.2.0 through 6.2.3 to talk to a Vault server over TLS. Exposure depends on how SslConfig is created: the flaw applies when build() is skipped, when the config is deserialized, or when VAULT_SSL_VERIFY holds a truthy value other than \"true\". Teams that verify with the default settings and use only the exact string \"true\" are not hit by the environment-variable or build() cases, and teams on 7.0.0 or later are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["hashicorpvault","high","java","package","vaultjavadriver"],"campaign_type":null,"first_public_at":"2026-11-05T08:17:03+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","cvss_by":"abd028dc-c042-4c4d-9749-38d0f850af89","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-109408","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109408","severity":null,"published_at":"2026-11-05T08:17:03+00:00","modified_at":"2026-11-05T08:17:03+00:00","first_seen_at":"2026-11-05T08:38:02+00:00","fetched_at":"2026-11-05T08:38:02+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}