Man-in-the-Middle Vulnerability in OpenList Frontend Affects Multiple Storage Drivers

CVE-2026-25060

What is CVE-2026-25060?

OpenList Frontend, a UI component for OpenList, contains a security flaw that disables TLS certificate verification by default across all storage driver communications. This misconfiguration allows attackers to perform Man-in-the-Middle (MitM) attacks, intercepting and altering communications between users and storage resources. By leveraging techniques such as ARP spoofing or utilizing rogue access points, attackers can redirect legitimate traffic to malicious servers, thereby facilitating data theft and manipulation without any security alerts being triggered. This critical issue has been addressed in version 4.1.10.

References