CVE-2026-26214
Published: 12 February 2026
Summary
CVE-2026-26214 is a critical-severity Improper Validation of Certificate with Host Mismatch (CWE-297) vulnerability. Its CVSS base score is 9.1 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Adversary-in-the-Middle (T1557); ranked at the 8.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SC-8 (Transmission Confidentiality and Integrity).
Deeper analysis
CVE-2026-26214 is a vulnerability in the Galaxy FDS Android SDK (XiaoMi/galaxy-fds-sdk-android), affecting versions 3.0.8 and prior. The issue stems from the SDK disabling TLS hostname verification when HTTPS is enabled, which is the default configuration via FDSClientConfiguration. In GalaxyFDSClientImpl.createHttpClient(), the SDK configures Apache HttpClient to use SSLSocketFactory.ALLOW_ALL_HOSTNAME_VERIFIER, accepting any valid TLS certificate irrespective of hostname mismatch. All applications using the SDK with default settings are therefore vulnerable. The flaw is classified under CWE-297 with a CVSS score of 7.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).
A man-in-the-middle attacker can exploit this vulnerability to intercept and modify communications between the SDK and Xiaomi FDS cloud storage endpoints. Successful exploitation requires network access and high attack complexity but no privileges or user interaction. Attackers can expose authentication credentials, file contents, and API responses, leading to high confidentiality and integrity impacts without affecting availability.
The XiaoMi/galaxy-fds-sdk-android open source project has reached end-of-life status, implying no official patches or updates are available. Mitigation details are covered in advisories from sources including VulnCheck and vulnerability research repositories linked to the CVE.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-7018
Vulnerability details
Galaxy FDS Android SDK (XiaoMi/galaxy-fds-sdk-android) version 3.0.8 and prior disable TLS hostname verification when HTTPS is enabled (the default configuration). In GalaxyFDSClientImpl.createHttpClient(), the SDK configures Apache HttpClient with SSLSocketFactory.ALLOW_ALL_HOSTNAME_VERIFIER, which accepts any valid TLS certificate regardless of hostname mismatch. Because…
more
HTTPS is enabled by default in FDSClientConfiguration, all applications using the SDK with default settings are affected. This vulnerability allows a man-in-the-middle attacker to intercept and modify SDK communications to Xiaomi FDS cloud storage endpoints, potentially exposing authentication credentials, file contents, and API responses. The XiaoMi/galaxy-fds-sdk-android open source project has reached end-of-life status.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability explicitly enables MITM interception/modification of TLS-protected traffic to cloud endpoints via disabled hostname verification (CWE-297), directly facilitating Adversary-in-the-Middle attacks.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires cryptographic protection of transmitted information confidentiality and integrity, which the CVE violates by disabling TLS hostname verification in the SDK's HttpClient configuration.
Requires mechanisms to ensure session authenticity, directly countering the MITM risk from SSLSocketFactory.ALLOW_ALL_HOSTNAME_VERIFIER accepting mismatched certificates.
Mandates correct configuration settings for security functions, which would prevent the default FDSClientConfiguration from using insecure ALLOW_ALL_HOSTNAME_VERIFIER.