CVE-2026-32148

Insufficient Verification of Data Authenticity vulnerability in hexpm hex (Hex.RemoteConverger module) allows dependency integrity bypass via unverified lockfile checksums. Hex stores checksums for dependencies in the mix.lock file to ensure reproducible and integrity-checked builds. However, Hex.RemoteConverger.verify_resolved/2 never executes checksum verification because the lock data returned by Hex.Utils.lock/1 uses string-based dependency names, while the verification logic compares against atom-based names. This type mismatch causes the verification code path to be silently skipped. Checksums are still validated when packages are initially downloaded from the registry, but mismatches between the lockfile and resolved dependencies are not detected. An attacker who can influence cached packages (e.g., via local cache poisoning or a compromised registry) can provide modified dependency contents that will be accepted without detection. The mix.lock file is silently rewritten with the checksum values from the registry, erasing evidence of tampering. This issue affects hex: from 0.16.0 before 2.4.2.

• CWE-354
• CWE-494

• https://cna.erlef.org/cves/CVE-2026-32148.htmlThird Party Advisory
• https://github.com/hexpm/hex/commit/d7528c8199a1144511508bf3a6460026a5a14c8ePatch
• https://github.com/hexpm/hex/security/advisories/GHSA-hmv9-4mfr-m92vExploit, Patch, Vendor Advisory
• https://osv.dev/vulnerability/EEF-CVE-2026-32148Exploit, Third Party Advisory
• https://github.com/hexpm/hex/security/advisories/GHSA-hmv9-4mfr-m92vExploit, Patch, Vendor Advisory

Published

Apr 30, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-32142Shopware is an open commerce platform. /api/_info/config rou…5.3
• CVE-2026-32143Discourse is an open-source discussion platform. From versio…6.5
• CVE-2026-32144Improper Certificate Validation vulnerability in Erlang OTP …7.4
• CVE-2026-32145Allocation of Resources Without Limits or Throttling vulnera…7.5
• CVE-2026-32146Improper path validation vulnerability in the Gleam compiler…7.8
• CVE-2026-32147Improper Limitation of a Pathname to a Restricted Directory …4.3
• CVE-2026-32149Improper input validation in Windows Hyper-V allows an autho…7.3
• CVE-2026-3215Improper Neutralization of Input During Web Page Generation …5.4
• CVE-2026-32150Concurrent execution using shared resource with improper syn…7
• CVE-2026-32151Exposure of sensitive information to an unauthorized actor i…6.5
• CVE-2026-32152Use after free in Desktop Window Manager allows an authorize…7.8
• CVE-2026-32153Use after free in Microsoft Windows Speech allows an authori…7.8