CVE-2026-90651

Socket Firewall (socketdev/socket-registry-firewall) in registry mode before 2.0.0 does not verify upstream TLS certificates by default. When the api_ssl_verify and upstream_ssl_verify configuration keys are omitted from socket.yml, the generated configuration sets SOCKET_API_SSL_VERIFY='false' and UPSTREAM_SSL_VERIFY='false', and the OpenResty/Lua HTTP client used for outbound requests accepts any certificate, including self-signed and otherwise untrusted certificates, without validating the chain. An attacker positioned to intercept traffic between Socket Firewall and the Socket API or an upstream package registry can present a crafted certificate and modify responses in transit, including substituting malicious package content or altering the allow/block decisions the firewall enforces. Setting api_ssl_verify: true and upstream_ssl_verify: true enables verification; however, in versions before 1.1.334, the generated nginx configuration did not emit lua_ssl_trusted_certificate, and thus verification could not be used successfully without manually patching the generated configuration. Version 2.0.0 changes the default for both settings to true.

• CWE-295

• https://docs.socket.dev/docs/registry-mode-configuration-reference
• https://github.com/SocketDev/socket-registry-firewall/releases/tag/v2.0.0

Published

Sep 13, 2026

Last Modified

Sep 13, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-90616In Flatpak before 1.18.1, a malicious sandboxed app can obta…7.4
• CVE-2026-9062The Store Locator WordPress plugin before 1.6.9 does not val…3.4
• CVE-2026-9064A flaw was found in 389-ds-base. The get_ldapmessage_control…7.5
• CVE-2026-90647ASE/Kalkitech ASE2000 V2 Communication Test Set 2.35 through…7.4
• CVE-2026-90648wasm2c in WebAssembly wabt through 1.0.41 allows sandbox esc…7.1
• CVE-2026-9065SureCart version prior to 4.2.1 are vulnerable to authentica…9.3
• CVE-2026-9066The WP Compress WordPress plugin before 7.10.04 does not va…6.1
• CVE-2026-90668The webserver in UnrealIRCd 6.0.5 through 6.2.6 before 6.2.7…7.5
• CVE-2026-9067The Schema & Structured Data for WP & AMP WordPress plugin b…9.1
• CVE-2026-90678An issue was discovered in HAProxy 3.3.0 through 3.4.4 and i…7.5
• CVE-2026-90679Forgejo 13.0.0 through 16.0.4, when "[federation] ENABLED = …4.3
• CVE-2026-9071IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSph…7.5