---
id: "CVE-2026-118682"
kind: "vulnerability"
aliases: ["CVE-2026-118682"]
title: "ClashMi: default TLS certificate check off lets forged updates run code"
severity: "high"
cvss: 7.7
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["clashmi", "macos", "other", "proxy-users", "windows"]
not_affected_if: ["fixed-version"]
published_at: "2026-10-28T22:17:12+00:00"
first_seen_at: "2026-10-28T22:35:34+00:00"
updated_at: "2026-10-28T22:36:44+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118682", "first_seen_at": "2026-10-28T22:35:34+00:00"}]
---

# ClashMi: default TLS certificate check off lets forged updates run code

ClashMi, a KaringX proxy client, disables TLS certificate validation by default in its HttpUtils helper through version 1.0.32.1801. An attacker running the user's proxy node can serve a forged update manifest without a sha256 value and deliver a malicious installer that runs when the update is applied.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed ClashMi version against `1.0.32.1801` (the sources list this as the last affected version)
- unknown for any configuration check, as the sources do not say how to confirm the default is still in effect

## Fix

- Move to a ClashMi release newer than `1.0.32.1801`; the sources do not name the fixed version
- unknown for any other mitigation, as the sources do not say

## Timeline

- 2026-10-28T22:35:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118682

## From the sources

KaringX ClashMi through 1.0.32.1801 disables TLS certificate validation by default in the HttpUtils helper, allowing attackers to intercept HTTPS traffic by presenting any certificate. Attackers operating the user's proxy node can serve a forged update manifest omitting sha256 to deliver a malicious installer, achieving code execution when the update runs.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_