Critical · published January 7, 2026
🔥 Danger alert! The Uniffle HTTP client is trusting all SSL certificates by default, making your REST API communications a prime target for Man-in-the-Middle (MITM) attacks! 🚨 Think of it like a restaurant that allows anyone to walk in without checking their ID — a sneaky impostor could sit down at your table and impersonate the chef, serving you whatever they want! If exploited, an attacker could intercept and manipulate the data exchanged between your client and the Uniffle Coordinator service, potentially leading to unauthorized access or data breaches. Imagine someone stealing your secret recipe while you're busy cooking!
Think of it like a restaurant that allows anyone to walk in without checking their ID — a sneaky impostor could sit down at your table and impersonate the chef, serving you whatever they want! The Uniffle client fails to validate SSL certificates and disables hostname verification, allowing any attacker on the network to eavesdrop or inject malicious content into the communication stream.
If exploited, an attacker could intercept and manipulate the data exchanged between your client and the Uniffle Coordinator service, potentially leading to unauthorized access or data breaches. Imagine someone stealing your secret recipe while you're busy cooking! Upgrade your Uniffle HTTP client to version 0.10.0 immediately to close this critical hole. Additionally, ensure SSL certificate validation is enabled and hostname verification is properly configured to prevent MITM attacks in the future. You've got this! With these actions, you’ll secure your communications in no time! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| apache/uniffle | < 0.10.0 | 0.10.0 |