PT-2026-1641 · Uniffle · Uniffle

Omkar Parkhe · Published 2026-01-07 · Updated 2026-02-15 · CVE-2025-68637

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Uniffle versions prior to 0.10.0

Description The Uniffle HTTP client is configured to trust all SSL certificates and disables hostname verification by default. This insecure configuration exposes all REST API communication between the Uniffle CLI/client and the Uniffle Coordinator service to potential Man-in-the-Middle (MITM) attacks. The vulnerable component is the HTTP client. The affected API communication involves REST API endpoints.

Recommendations Upgrade to version 0.10.0.

Fix

Weakness Enumeration

CWE-297

Related Identifiers

CVE-2025-68637

Affected Products

Uniffle

References · 10

• https://osv.dev/vulnerability/CVE-2025-68637 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-68637 · Security Note
• https://lists.apache.org/thread/trvdd11hmpbjno3t8rc9okr4t036ox2v · Vendor Advisory
• https://twitter.com/CVEnew/status/2008846155367518619 · Twitter Post
• https://twitter.com/TheHackerWire/status/2008935718333350089 · Twitter Post
• https://twitter.com/Komodosec/status/2022868527108231583 · Twitter Post
• https://twitter.com/transilienceai/status/2022876203015864514 · Twitter Post
• http://openwall.com/lists/oss-security/2025/12/27/2 · Note
• https://t.me/CVEtracker/41594 · Telegram Post
• https://t.me/pentestingnews/72250 · Telegram Post