CVE-2026-54481

11th percentile - higher than 11% of all known CVEs

The internal API HTTP client hardcodes InsecureSkipVerify:true with no config override, disabling TLS certificate verification. This violates CWE-295 (improper certificate validation).

A man-in-the-middle attacker could intercept or modify traffic between components, potentially leading to data leakage or system integrity compromise.

Modify the code to enable certificate verification by default and allow configuration. If necessary, use a secure certificate store.