Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-118682— ClashMi through 1.0.32.1801 Disabled TLS Certificate Validation Enables Update MITM

Quick assessment

Affected
KaringX clashmi
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

KaringX ClashMi（版本至 1.0.32.1801）在其 HttpUtils 辅助模块中默认禁用了 TLS 证书验证，这使得攻击者能够通过提供任意证书来拦截 HTTPS 流量。若攻击者控制用户所使用的代理节点，便可提供一份伪造的更新清单（其中省略了 SHA256 校验值），从而分发恶意的安装程序；当用户执行更新时，该恶意程序将得以执行，最终实现代码执行攻击。

CVSS 7.5 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-118682

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
ClashMi through 1.0.32.1801 Disabled TLS Certificate Validation Enables Update MITM
Source: CVE Program / CVE List V5
Vulnerability Description
KaringX ClashMi through 1.0.32.1801 disables TLS certificate validation by default in the HttpUtils helper, allowing attackers to intercept HTTPS traffic by presenting any certificate. Attackers operating the user's proxy node can serve a forged update manifest omitting sha256 to deliver a malicious installer, achieving code execution when the update runs.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
证书验证不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
KaringX clashmi 0 ~ 1.0.32.1801 -

II. Public POCs for CVE-2026-118682

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-118682

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-118682 (1)

Vendor Advisories for CVE-2026-118682 (1)

Other References for CVE-2026-118682 (4)

IV. Related Vulnerabilities

Same weakness: CWE-295