CVE-2026-109408
Description
A flaw was found in vault-java-driver. Under certain configuration conditions, the driver fails to properly enforce Transport Layer Security (TLS) certificate and hostname verification even when verification has been requested. An attacker positioned on the network path between the client and the server can exploit this issue to intercept communication, leading to information disclosure of sensitive authentication tokens and secrets, or the forgery of server responses.
Statement
Red Hat has evaluated this vulnerability as having an Important severity impact because an unintended failure to validate TLS certificates allows an attacker with network-level access to intercept sensitive authentication tokens and confidential credentials. This risk is rated Important rather than Critical or Moderate because exploitation requires the adversary to occupy an on-path position between the client service and HashiCorp Vault. In typical Red Hat enterprise environments, applications utilizing this driver within secured private networks or container meshes face reduced risk, though exposure increases if traffic traverses unsegmented or public infrastructure.
Mitigation
Configure the client environment to explicitly enforce TLS verification using the canonical string value:
1. Set the environment variable strictly to the literal string "true":
bash
export VAULT_SSL_VERIFY="true"
2. In systemd service unit files or container definitions, ensure `VAULT_SSL_VERIFY=true` is defined instead of alternative truthy values such as `1`, `yes`, or `on`.
3. Restrict and isolate network communication between client workloads and the HashiCorp Vault service to trusted subnets, private container networks, or encrypted transport tunnels (such as IPsec) to prevent on-path traffic interception.
Warning: Applying environment variable or service configuration changes requires restarting the affected application service to take effect.
Understanding the Weakness (CWE)
Integrity,Authentication
Technical Impact: Bypass Protection Mechanism; Gain Privileges or Assume Identity
When a certificate is invalid or malicious, it might allow an attacker to spoof a trusted entity by interfering in the communication path between the host and client. The product might connect to a malicious host while believing it is a trusted host, or the product might be deceived into accepting spoofed data that appears to originate from a trusted host.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
