Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
OpenList Frontend is a UI component for OpenList. Prior to 4.1.10, certificate verification is disabled by default for all storage driver communications. The TlsInsecureSkipVerify setting is default to true in the DefaultConfig() function in internal/conf/config.go. This vulnerability enables Man-in-the-Middle (MitM) attacks by disabling TLS certificate verification, allowing attackers to intercept and manipulate all storage communications. Attackers can exploit this through network-level attacks like ARP spoofing, rogue Wi-Fi access points, or compromised internal network equipment to redirect traffic to malicious endpoints. Since certificate validation is skipped, the system will unknowingly establish encrypted connections with attacker-controlled servers, enabling full decryption, data theft, and manipulation of all storage operations without triggering any security warnings. This vulnerability is fixed in 4.1.10.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-02-02 | 1 | Patch1 |
| 2026-02-03 | 1 | Disclosure1 |
CVE-2026-25060 TLS Certificate Verification Bypass in OpenList Frontend Before 4.1.10 Enables MitM Attacks https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-25060
Post summary
CVE-2026-25060 is a TLS certificate verification bypass in OpenList Frontend versions before 4.1.10, allowing Man‑in‑the‑Middle attacks.
CVE-2026-25060 OpenList Frontend is a UI component for OpenList. Prior to 4.1.10, certificate verification is disabled by default for all storage driver communications. The TlsInsec… https://www.cve.org/CVERecord?id=CVE-2026-25060
Post summary
The CVE-2026-25060 vulnerability in OpenList Frontend involves disabled certificate verification for storage driver communications before version 4.1.10, and the issue is resolved by updating to 4.1.10 or later.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | oplist | openlist | - | - | - |