{"id":"CVE-2026-118682","kind":"vulnerability","aliases":["CVE-2026-118682"],"related":[],"title":"ClashMi: default TLS certificate check off lets forged updates run code","description":"KaringX ClashMi through 1.0.32.1801 disables TLS certificate validation by default in the HttpUtils helper, allowing attackers to intercept HTTPS traffic by presenting any certificate. Attackers operating the user's proxy node can serve a forged update manifest omitting sha256 to deliver a malicious installer, achieving code execution when the update runs.","summary":"ClashMi, a KaringX proxy client, disables TLS certificate validation by default in its HttpUtils helper through version 1.0.32.1801. An attacker running the user's proxy node can serve a forged update manifest without a sha256 value and deliver a malicious installer that runs when the update is applied.","severity":"high","cvss":7.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["clashmi","macos","other","proxy-users","windows"],"not_affected_if":["fixed-version"],"how_to_check":"- Check the installed ClashMi version against `1.0.32.1801` (the sources list this as the last affected version)\n- unknown for any configuration check, as the sources do not say how to confirm the default is still in effect","fix":"- Move to a ClashMi release newer than `1.0.32.1801`; the sources do not name the fixed version\n- unknown for any other mitigation, as the sources do not say","status":"open","published_at":"2026-10-28T22:17:12+00:00","first_seen_at":"2026-10-28T22:35:34+00:00","triaged_at":"2026-10-28T22:36:44+00:00","updated_at":"2026-10-28T22:36:44+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-28T22:36:44Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a ClashMi release newer than `1.0.32.1801`; the sources do not name the fixed version\n- unknown for any other mitigation, as the sources do not say","reach":"network","title":"ClashMi: default TLS certificate check off lets forged updates run code","impact":"high","summary":"ClashMi, a KaringX proxy client, disables TLS certificate validation by default in its HttpUtils helper through version 1.0.32.1801. An attacker running the user's proxy node can serve a forged update manifest without a sha256 value and deliver a malicious installer that runs when the update is applied.","category":"other","nicknames":[],"who_cares":["clashmi","windows","macos","proxy-users"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker runs code on the machine via forged installer","analyst_note":"Confirm the fixed version and platforms from the vendor or NVD page, and whether the update installer is run automatically.","how_to_check":"- Check the installed ClashMi version against `1.0.32.1801` (the sources list this as the last affected version)\n- unknown for any configuration check, as the sources do not say how to confirm the default is still in effect","needs_analyst":true,"not_affected_if":["fixed-version"],"who_is_affected":"Users of ClashMi through 1.0.32.1801 who route traffic through a proxy node they do not fully control, or who accept its update checks, are exposed. The sources do not say whether managed or enterprise deployments change the default. Users on newer releases, or who do not run ClashMi's update function, can skip it.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000624,"input_tokens":3349,"output_tokens":579,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-118682':14A,17A '-2026':13A,16A '1.0.32.1801':42B,76C 'achiev':117C 'allow':87C 'appli':72B 'attack':44B,88C,97C 'certif':4A,32B,79C,96C 'check':5A 'clashmi':1A,18B,25B,74C 'client':29B 'code':11A,118C 'cve':12A,15A 'default':2A,35B,82C 'deliv':62B,113C 'disabl':30B,77C 'execut':119C 'forg':8A,54B,107C 'helper':39B,86C 'https':91C 'httputil':38B,85C 'instal':65B,116C 'intercept':90C 'karingx':27B,73C 'let':7A 'maco':19B 'malici':64B,115C 'manifest':56B,109C 'node':50B,103C 'omit':110C 'oper':98C 'present':94C 'proxi':22B,28B,49B,102C 'proxy-us':21B 'run':10A,45B,67B,123C 'serv':52B,105C 'sha256':59B,111C 'tls':3A,31B,78C 'traffic':92C 'updat':9A,55B,70B,108C,122C 'user':23B,47B,100C 'valid':33B,80C 'valu':60B 'version':41B 'window':24B 'without':57B","nicknames":[],"mitigations":[],"who_affected":"Users of ClashMi through 1.0.32.1801 who route traffic through a proxy node they do not fully control, or who accept its update checks, are exposed. The sources do not say whether managed or enterprise deployments change the default. Users on newer releases, or who do not run ClashMi's update function, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T22:17:12+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118682","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118682","severity":null,"published_at":"2026-10-28T22:17:12+00:00","modified_at":"2026-10-28T22:17:12+00:00","first_seen_at":"2026-10-28T22:35:34+00:00","fetched_at":"2026-10-28T22:35:34+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}