CVE-2026-90651 | CVSS: 8.1 | 严重级别: HIGH
Socket Firewall (socketdev/socket-registry-firewall) in registry mode before 2.0.0 does not verify upstream TLS certificates by default. When the api_ssl_verify and upstream_ssl_verify configuration keys are omitted from socket.yml, the generated configuration sets SOCKET_API_SSL_VERIFY='false' and UPSTREAM_SSL_VERIFY='false', and the OpenResty/Lua HTTP client used for outbound requests accepts any certificate, including self-signed and otherwise untrusted certificates, without validating the chain. An attacker positioned to intercept traffic between Socket Firewall and the Socket API or an up
参考链接:
• https://docs.socket.dev/docs/registry-mode-configuration-reference
• https://github.com/SocketDev/socket-registry-firewall/releases/tag/v2.0.0
📌 数据来源: NVD 官方