OpenList has Insecure TLS Default Configuration
Date: 2026-02
Affected: go/github.com/OpenListTeam/OpenList/v4
Attack vector: other
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2026-25060
CWE: CWE-599
CVSS: 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)

### Summary The application disables TLS certificate verification by default for all outgoing storage driver communications, making the system vulnerable to Man-in-the-Middle (MitM) attacks. This enables the complete decryption, theft, and manipulation of all data transmitted during storage operations, severely compromising the confidentiality and integrity of user data. ### Details Certificate verification is disabled by default for all storage driver communications. The `TlsInsecureSkipVerify` setting is default to true in the `DefaultConfig()` function in [internal/conf/config.go](https://github.com/OpenListTeam/OpenList/blob/5db2172ed681346b69ed468c73c1f01b6ed455ea/internal/conf/config.go#L185). ~~~ func DefaultConfig() *Config { // ... TlsInsecureSkipVerify: true, // ... } ~~~ This vulnerability enables Man-in-the-Middle (MitM) attacks by disabling TLS certificate verification, allowing attackers to intercept and manipulate all storage communications. Attackers can exploit this through network-level attacks like ARP spoofing, rogue Wi-Fi access points, or compromised internal network equipment to redirect traffic to malicious endpoints. Since certificate validation is skipped, the system will unknowingly establish encrypted connections with attacker-controlled servers, enabling full decryption, data theft, and manipulation of all storage operations without triggering any security warnings. ### PoC We modified the /etc/hostsfile to simulate DNS hijacking


Mitigations:

Architectural layers (MAESTRO):