CVE-2026-32303 Cryptomator: Tampered vault configuration allows MITM attack on Hub API

High 7.6 Published 20 Mar 2026 Updated 23 Mar 2026

Attackers can tamper with vault configuration to bypass host authenticity checks, enabling man-in-the-middle attacks and token exfiltration.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2026-32303?

CVE-2026-32303 is a high-severity vulnerability in cryptomator, published on 20 Mar 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

Cryptomator encrypts data being stored on cloud infrastructure. Prior to version 1.19.1, an integrity check vulnerability allows an attacker to tamper with the vault configuration file leading to a man-in-the-middle vulnerability in Hub key loading mechanism. Before this fix, the client trusted endpoints from the vault config without host authenticity checks, which could allow token exfiltration by mixing a legitimate auth endpoint with a malicious API endpoint. Impacted are users unlocking Hub-backed vaults with affected client versions in environments where an attacker can alter the vault.cryptomator file. This issue has been patched in version 1.19.1.

Weakness: CWE-923, CWE-451, CWE-354, CWE-346

Which versions are affected by CVE-2026-32303?

It affects 1 product.

Products include Cryptomator Cryptomator.

How do I fix CVE-2026-32303?

No fix has been published for CVE-2026-32303 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-32303 being exploited?

There is no known exploitation of CVE-2026-32303 in the wild and no public exploit code.

Sources

Also known as GHSA-34rf-rwr3-7g43.