CVE-2026-118682
ClashMi through 1.0.32.1801 Disabled TLS Certificate Validation Enables Update MITM
CVSS Score
7.5
EPSS Score
0.0%
EPSS Percentile
0th
KaringX ClashMi through 1.0.32.1801 disables TLS certificate validation by default in the HttpUtils helper, allowing attackers to intercept HTTPS traffic by presenting any certificate. Attackers operating the user's proxy node can serve a forged update manifest omitting sha256 to deliver a malicious installer, achieving code execution when the update runs.
| CWE | CWE-295 |
| Vendor | karingx |
| Product | clashmi |
| Published | Oct 28, 2026 |
Stay Ahead of the Next One
Get instant alerts for karingx clashmi
Be the first to know when new high vulnerabilities affecting karingx clashmi are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
KaringX / clashmi
0 ≤ 1.0.32.1801
References
github.com: https://github.com/KaringX/clashmi/issues/605 github.com: https://github.com/KaringX/clashmi github.com: https://github.com/KaringX/clashmi/blob/v1.0.32.1801/lib/app/utils/http_utils.dart#L674-L676 github.com: https://github.com/KaringX/clashmi/blob/v1.0.32.1801/lib/app/modules/setting_manager.dart#L225 github.com: https://github.com/KaringX/clashmi/blob/v1.0.32.1801/lib/app/modules/auto_update_manager.dart#L293 vulncheck.com: https://www.vulncheck.com/advisories/clashmi-through-1.0.32.1801-disabled-tls-certificate-validation-enables-update-mitm
Credits
George Chen