TLS Verification Bypass in Socket Firewall by SocketDev
CVE-2026-90651

8.1HIGH

Key Information:

Vendor

Socket

Status
Socket Firewall
Vendor
CVE Published:
12 September 2026

What is CVE-2026-90651?

The Socket Firewall in registry mode prior to version 2.0.0 fails to verify upstream TLS certificates by default, posing significant security risks. When the configuration settings api_ssl_verify and upstream_ssl_verify are not specified in socket.yml, the firewall is set to accept all certificates without validation. This allows attackers to intercept communication between the firewall and the Socket API or upstream packages, potentially leading to the injection of malicious content or manipulation of response decisions. Users can enable verification by configuring api_ssl_verify and upstream_ssl_verify to true, but earlier versions lack effective implementations. Upgrading to version 2.0.0 or later is crucial for enhanced security.

Affected Version(s)

Socket Firewall 0 < 2.0.0

References

https://github.com/SocketDev/socket-registry-firewall/rel...
https://docs.socket.dev/docs/registry-mode-configuration-...

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.