CVE-2026-26214

Galaxy FDS Android SDK (XiaoMi/galaxy-fds-sdk-android) version 3.0.8 and prior disable TLS hostname verification when HTTPS is enabled (the default configuration). In GalaxyFDSClientImpl.createHttpClient(), the SDK configures Apache HttpClient with SSLSocketFactory.ALLOW_ALL_HOSTNAME_VERIFIER, which accepts any valid TLS certificate regardless of hostname mismatch. Because HTTPS is enabled by default in FDSClientConfiguration, all applications using the SDK with default settings are affected. This vulnerability allows a man-in-the-middle attacker to intercept and modify SDK communications to Xiaomi FDS cloud storage endpoints, potentially exposing authentication credentials, file contents, and API responses. The XiaoMi/galaxy-fds-sdk-android open source project has reached end-of-life status.

• CWE-297

• https://github.com/XavLimSG/Vulnerability-Research/blob/main/CVE-2026-26214/CVE-2026-26214.md
• https://github.com/XiaoMi/galaxy-fds-sdk-android
• https://www.vulncheck.com/advisories/xiaomi-galaxy-fds-android-sdk-tls-hostname-verification-disabled-enables-mitm

Published

Feb 12, 2026

Last Modified

Jul 14, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-26207Discourse is an open source discussion platform. Prior to ve…5.4
• CVE-2026-26208ADB Explorer is a fluent UI for ADB on Windows. Prior to Bet…7.8
• CVE-2026-26209cbor2 provides encoding and decoding for the Concise Binary …7.5
• CVE-2026-2621A security vulnerability has been detected in Sciyon Koyuan …7.3
• CVE-2026-26210KTransformers through 0.5.3 contains an unsafe deserializati…9.8
• CVE-2026-26213thingino-firmware versions up to the firmware-2026-03-16 rel…9.8
• CVE-2026-26215manga-image-translator version beta-0.3 and prior in shared …9.3
• CVE-2026-26216Crawl4AI versions prior to 0.8.0 contain a remote code execu…10
• CVE-2026-26217Crawl4AI versions prior to 0.8.0 contain a local file inclus…7.5
• CVE-2026-26218newbee-mall includes pre-seeded administrator accounts in it…9.8
• CVE-2026-26219newbee-mall stores and verifies user passwords using an unsa…9.3
• CVE-2026-2622A vulnerability was detected in Blossom up to 1.17.1. This v…5.4