CVE-2026-26214
Published: 12 February 2026
Summary
CVE-2026-26214 is a high-severity Improper Validation of Certificate with Host Mismatch (CWE-297) vulnerability. Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Adversary-in-the-Middle (T1557); ranked at the 9.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Threat & Defense at a Glance
Threat & Defense Details
Likely Mitigating ControlsAI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Approved PKI issuance and trust stores enforce full certificate validation steps including name/hostname checks.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability explicitly enables MITM interception/modification of TLS-protected traffic to cloud endpoints via disabled hostname verification (CWE-297), directly facilitating Adversary-in-the-Middle attacks.
NVD Description
Galaxy FDS Android SDK (XiaoMi/galaxy-fds-sdk-android) version 3.0.8 and prior disable TLS hostname verification when HTTPS is enabled (the default configuration). In GalaxyFDSClientImpl.createHttpClient(), the SDK configures Apache HttpClient with SSLSocketFactory.ALLOW_ALL_HOSTNAME_VERIFIER, which accepts any valid TLS certificate regardless of hostname mismatch. Because…
more
HTTPS is enabled by default in FDSClientConfiguration, all applications using the SDK with default settings are affected. This vulnerability allows a man-in-the-middle attacker to intercept and modify SDK communications to Xiaomi FDS cloud storage endpoints, potentially exposing authentication credentials, file contents, and API responses. The XiaoMi/galaxy-fds-sdk-android open source project has reached end-of-life status.
Deeper analysisAI
CVE-2026-26214 is a vulnerability in the Galaxy FDS Android SDK (XiaoMi/galaxy-fds-sdk-android), affecting versions 3.0.8 and prior. The issue stems from the SDK disabling TLS hostname verification when HTTPS is enabled, which is the default configuration via FDSClientConfiguration. In GalaxyFDSClientImpl.createHttpClient(), the SDK configures Apache HttpClient to use SSLSocketFactory.ALLOW_ALL_HOSTNAME_VERIFIER, accepting any valid TLS certificate irrespective of hostname mismatch. All applications using the SDK with default settings are therefore vulnerable. The flaw is classified under CWE-297 with a CVSS score of 7.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).
A man-in-the-middle attacker can exploit this vulnerability to intercept and modify communications between the SDK and Xiaomi FDS cloud storage endpoints. Successful exploitation requires network access and high attack complexity but no privileges or user interaction. Attackers can expose authentication credentials, file contents, and API responses, leading to high confidentiality and integrity impacts without affecting availability.
The XiaoMi/galaxy-fds-sdk-android open source project has reached end-of-life status, implying no official patches or updates are available. Mitigation details are covered in advisories from sources including VulnCheck and vulnerability research repositories linked to the CVE.
Details
- CWE(s)