---
id: "CVE-2026-109408"
kind: "vulnerability"
aliases: ["CVE-2026-109408"]
title: "vault-java-driver: TLS certificate and hostname checks silently disabled in three cases"
severity: "high"
cvss: 7.4
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["hashicorp-vault", "java", "package", "vault-java-driver"]
not_affected_if: ["default-config", "version-7.0.0-or-later"]
published_at: "2026-11-05T08:17:03+00:00"
first_seen_at: "2026-11-05T08:38:02+00:00"
updated_at: "2026-11-05T08:39:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109408", "first_seen_at": "2026-11-05T08:38:02+00:00"}]
exploit_sources: []
---

# vault-java-driver: TLS certificate and hostname checks silently disabled in three cases

The Java client for HashiCorp Vault turns off TLS certificate and hostname verification when an SslConfig is built without build(), restored by Java deserialization, or set via VAULT_SSL_VERIFY to values such as 1, yes or on. An attacker on the network path to the Vault server can read the Vault token and secrets in transit and forge responses.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the version of `io.github.jopenlibs:vault-java-driver` in the build file (pom.xml or build.gradle) and whether it falls in 5.2.0 through 6.2.3.
- Search the code for `VaultConfig` with an `SslConfig` that skips `build()`, and for `VAULT_SSL_VERIFY` set to a value other than `true`.

## Fix

- `io.github.jopenlibs:vault-java-driver` upgrade to `7.0.0`

## Timeline

- 2026-11-05T08:38:02+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-109408

## From the sources

vault-java-driver, a Java client for HashiCorp Vault, silently disables TLS certificate and hostname verification in three states where the caller asked for verification: an SslConfig passed to VaultConfig without calling build(), an SslConfig restored by Java deserialization, and VAULT_SSL_VERIFY set to a truthy value other than "true", such as 1, yes or on. In each case SslConfig.isVerify() returns false and the driver installs a trust-all SSLContext. An attacker on the network path to the Vault server can then read the Vault token and secrets in transit and forge responses. This issue affects io.github.jopenlibs:vault-java-driver 5.2.0 through 6.2.3. It is fixed in 7.0.0.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_