CVE-2026-118682: ClashMi through 1.0.32.1801 Disabled TLS Certificate Validation Enables Update MITM
KaringX ClashMi through 1.0.32.1801 disables TLS certificate validation by default in the HttpUtils helper, allowing attackers to intercept HTTPS traffic by presenting any certificate. Attackers operating the user's proxy node can serve a forged update manifest omitting sha256 to deliver a malicious installer, achieving code execution when the update runs.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Enable TLS certificate validation in the HttpUtils helper; it is disabled by default through version 1.0.32.1801.
ClashMi HttpUtils helper TLS certificate validation = enabled
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of ClashMi through version 1.0.32.1801 are exposed because TLS certificate validation is disabled by default in the HttpUtils helper. Exploitation is specifically possible when an attacker operates the user's proxy node and can intercept the application's HTTPS traffic.
What must an attacker do to achieve code execution?
The attacker must intercept HTTPS traffic and present an arbitrary certificate, then serve a forged update manifest that omits sha256. If the user runs the delivered update installer, the attacker can achieve code execution.
Is user interaction required?
Yes. The available vector indicates user interaction is required, and the described code-execution path occurs when the malicious update installer is run.