CVE-2025-68637

Critical

Published: 07/01/2026(UTC)Translated: 05/08/2026(UTC)NVD NIST

Summary

The Uniffle HTTP client is configured to trust all SSL certificates and disables hostname verification by default. This insecure configuration exposes REST API communication to Man-in-the-Middle (MITM) attacks.

Risk Assessment

Attackers can intercept and modify communication, leading to data leakage or manipulation of operations.

Recommendation

Upgrade Uniffle to version 0.10.0 or later. Ensure certificate and hostname verification is enabled.

Original NVD description (English source)

The Uniffle HTTP client is configured to trust all SSL certificates and disables hostname verification by default. This insecure configuration exposes all REST API communication between the Uniffle CLI/client and the Uniffle Coordinator service to potential Man-in-the-Middle (MITM) attacks. This issue affects all versions from before 0.10.0. Users are recommended to upgrade to version 0.10.0, which fixes the issue.