Live › vulnerability › CVE-2026-118682
Go to dashboardClashMi, a KaringX proxy client, disables TLS certificate validation by default in its HttpUtils helper through version 1.0.32.1801. An attacker running the user's proxy node can serve a forged update manifest without a sha256 value and deliver a malicious installer that runs when the update is applied.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 22:35 UTC. All times on this page are UTC.
Users of ClashMi through 1.0.32.1801 who route traffic through a proxy node they do not fully control, or who accept its update checks, are exposed. The sources do not say whether managed or enterprise deployments change the default. Users on newer releases, or who do not run ClashMi's update function, can skip it.
No product ranges from the sources yet.
1.0.32.1801 (the sources list this as the last affected version)1.0.32.1801; the sources do not name the fixed versionEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
KaringX ClashMi through 1.0.32.1801 disables TLS certificate validation by default in the HttpUtils helper, allowing attackers to intercept HTTPS traffic by presenting any certificate. Attackers operating the user's proxy node can serve a forged update manifest omitting sha256 to deliver a malicious installer, achieving code execution when the update runs.
This page as .md · .json · in your agent: get_signal("CVE-2026-118682")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.