Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Socket Firewall (socketdev/socket-registry-firewall) in registry mode before 2.0.0 does not verify upstream TLS certificates by default. When the api_ssl_verify and upstream_ssl_verify configuration keys are omitted from socket.yml, the generated configuration sets SOCKET_API_SSL_VERIFY='false' and UPSTREAM_SSL_VERIFY='false', and the OpenResty/Lua HTTP client used for outbound requests accepts any certificate, including self-signed and otherwise untrusted certificates, without validating the chain. An attacker positioned to intercept traffic between Socket Firewall and the Socket API or an upstream package registry can present a crafted certificate and modify responses in transit, including substituting malicious package content or altering the allow/block decisions the firewall enforces. Setting api_ssl_verify: true and upstream_ssl_verify: true enables verification; however, in versions before 1.1.334, the generated nginx configuration did not emit lua_ssl_trusted_certificate, and thus verification could not be used successfully without manually patching the generated configuration. Version 2.0.0 changes the default for both settings to true.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
socket today / cve-2026-90651 / their registry firewall defaulted tls verify to false / a mitm can swap the packages you thought you blocked / fixed in 2.0.0 / you still running pre-2? https://www.tenable.com/cve/CVE-2026-90651
Post summary
The text reports that CVE-2026-90651 was fixed in version 2.0.0 due to a TLS verification flaw that could allow MITM package substitution.
CVE-2026-90651 Socket Firewall (socketdev/socket-registry-firewall) in registry mode before 2.0.0 does not verify upstream TLS certificates by default. When the api_ssl_verify and u… https://www.cve.org/CVERecord?id=CVE-2026-90651
Post summary
The post discloses that socketdev/socket-registry-firewall versions pre‑2.0.0 incorrectly skip upstream TLS certificate verification, but it does not mention a PoC, exploit, or patch.
Socket Firewall did not verify TLS to the registries it guards. Before 2.0.0, an attacker in the path could substitute package content or rewrite the firewall's own allow/block decisions. No exploitation reported. https://severitydaily.com/socket-firewall-cve-2026-90651-no-upstream-tls-verification-registry-mode/
Post summary
Socket Firewall versions prior to 2.0.0 failed to verify TLS when communicating with registries, enabling path attackers to replace package contents or alter firewall rules. No active exploitation or patches have been reported.