TLS Verification Issues in vault-java-driver by HashiCorp
CVE-2026-109408

7.4HIGH

Key Information:

Vendor

Jopenlibs

Status
Vault-java-driver
Vendor
CVE Published:
5 November 2026

What is CVE-2026-109408?

The vault-java-driver for HashiCorp Vault contains a vulnerability that compromises TLS certificate and hostname verification, potentially leading to significant data security risks. In specific configurations, including a misconfigured SslConfig instance, the driver leads to a trust-all SSL context, effectively disabling verification. This allows an attacker on the network path to intercept sensitive information, including Vault tokens and secrets, exposing them to unauthorized parties. Users should upgrade to version 7.0.0 or later to mitigate these security concerns.

Affected Version(s)

vault-java-driver 5.2.0 < 7.0.0

References

https://github.com/jopenlibs/vault-java-driver/pull/78
patch
https://repo.maven.apache.org/maven2/io/github/jopenlibs/...
patch

CVSS V3.1

Score:
7.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Yuval Saggie and Mor Wienberger (powered by Echo Frontier)
.