PT-2026-26657 · Unknown · Cryptomator

Yanchon918S · Publicado 2026-03-20 · Atualizado 2026-03-22 · CVE-2026-32309

Positive Technologies (AI Summary)

CVSS v4.0

8.7

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Cryptomator versions prior to 1.19.1

Description Cryptomator encrypts data stored on cloud infrastructure. The Hub-based unlock flow, in versions before 1.19.1, allows the use of hub+http and retrieves Hub endpoints from vault metadata without requiring HTTPS. This can lead to OAuth and key-loading traffic being transmitted over insecure HTTP connections, potentially exposing bearer tokens and endpoint trust decisions to interception and tampering by a network attacker. The issue is related to the handling of Hub endpoints and the lack of HTTPS enforcement during the unlock process.

Recommendations Update to version 1.19.1 or later.

Exploit

Correção

Cleartext Transmission of Sensitive Information

Enumeração de Fraquezas

CWE-319

Identificadores relacionados

CVE-2026-32309

GHSA-VV33-H7QX-C264

Produtos afetados

Cryptomator

Referências · 6

• 🔥 https://github.com/cryptomator/cryptomator/security/advisories/GHSA-vv33-h7qx-c264 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32309.json · Exploit
• https://github.com/cryptomator/cryptomator/releases/tag/1.19.1 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-32309 · Nota de Segurança
• https://twitter.com/CVEnew/status/2035619780712100331 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-32309 · Aviso do Fabricante