High severity · published Oct 28, 2026
CVE-2026-118682
ClashMi through 1.0.32.1801 Disabled TLS Certificate Validation Enables Update MITM
New
7.5
CVSS
–
EPSS
No
On KEV
Description
KaringX ClashMi through 1.0.32.1801 disables TLS certificate validation by default in the HttpUtils helper, allowing attackers to intercept HTTPS traffic by presenting any certificate. Attackers operating the user's proxy node can serve a forged update manifest omitting sha256 to deliver a malicious installer, achieving code execution when the update runs.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CL
clashmi · KaringX
through 1.0.32.1801 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-118682
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-118682
github.com
https://github.com/KaringX/clashmi
github.com
https://github.com/KaringX/clashmi/blob/v1.0.32.1801/lib/app/modules/auto_update_manager.dart#L293
github.com
https://github.com/KaringX/clashmi/blob/v1.0.32.1801/lib/app/modules/setting_manager.dart#L225
github.com
https://github.com/KaringX/clashmi/blob/v1.0.32.1801/lib/app/utils/http_utils.dart#L674-L676
github.com
https://github.com/KaringX/clashmi/issues/605
www.vulncheck.com
https://www.vulncheck.com/advisories/clashmi-through-1.0.32.1801-disabled-tls-certificate-validation-enables-update-mitm