Integrity Check Vulnerability in Cryptomator Affects Cloud Data Security

CVE-2026-32303

What is CVE-2026-32303?

An integrity check vulnerability in Cryptomator, prior to version 1.19.1, could allow attackers to tamper with the vault configuration file. This flaw leads to a man-in-the-middle vulnerability in the Hub key loading mechanism. Clients trusted endpoints from the vault config without ensuring host authenticity, potentially exposing users to token exfiltration through a mix of legitimate and malicious API endpoints. Users who unlock Hub-backed vaults with affected client versions in environments where the vault.cryptomator file can be altered are at risk. The issue has been addressed in version 1.19.1.

References