CVE-2026-25060 OpenList Insecure TLS Default Configuration
OpenList frontend disables TLS certificate verification by default, allowing Man-in-the-Middle attackers to intercept and manipulate storage communications.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-25060?
CVE-2026-25060 is a high-severity vulnerability in OpenListTeam OpenList, published on 2 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
OpenList Frontend is a UI component for OpenList. Prior to 4.1.10, certificate verification is disabled by default for all storage driver communications. The TlsInsecureSkipVerify setting is default to true in the DefaultConfig() function in internal/conf/config.go. This vulnerability enables Man-in-the-Middle (MitM) attacks by disabling TLS certificate verification, allowing attackers to intercept and manipulate all storage communications. Attackers can exploit this through network-level attacks like ARP spoofing, rogue Wi-Fi access points, or compromised internal network equipment to redirect traffic to malicious endpoints. Since certificate validation is skipped, the system will unknowingly establish encrypted connections with attacker-controlled servers, enabling full decryption, data theft, and manipulation of all storage operations without triggering any security warnings. This vulnerability is fixed in 4.1.10.
Weakness: CWE-599
Which versions are affected by CVE-2026-25060?
5 open source packages ship an affected version, including github.com/OpenListTeam/OpenList/v4, github.com/OpenListTeam/OpenList and github.com/OpenListTeam/OpenList/v3. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/OpenListTeam/OpenList/v4 Go | All versions | 4.1.10 |
github.com/OpenListTeam/OpenList/v4 Go | All versions | 4.1.10 |
github.com/OpenListTeam/OpenList/v4 Go | All versions | 4.1.10 |
github.com/OpenListTeam/OpenList Go | All versions | None |
github.com/OpenListTeam/OpenList/v3 Go | All versions | None |
Products include Oplist Openlist.
How do I fix CVE-2026-25060?
Upgrade github.com/OpenListTeam/OpenList/v4 to 4.1.10 or later.
Is CVE-2026-25060 being exploited?
There is no known exploitation of CVE-2026-25060 in the wild and no public exploit code.
Other vulnerabilities in OpenListTeam OpenList
Sources
Also known as GHSA-wf93-3ghh-h389, GO-2026-4397.