TLS Certificate Validation Issue in ClashMi by KaringX

CVE-2026-118682

What is CVE-2026-118682?

The ClashMi application by KaringX, up to version 1.0.32.1801, has a significant vulnerability where TLS certificate validation is disabled by default in its HttpUtils component. This flaw allows attackers to intercept HTTPS traffic by presenting any certificate. By operating a proxy node within the user's network, an adversary can serve a malicious update manifest without a proper sha256 checksum, leading to the installation of malicious software that can execute arbitrary code during the update process. This vulnerability poses serious security concerns, as it enables Man-in-the-Middle (MITM) attacks, potentially compromising data integrity and user security.

References