← Back to the live CVE advisory feed

CVE-2026-90651: Socket Firewall

Severity

8.1 (HIGH)

Vendor

SOCKET

Affected versions

0 through before 2.0.0

Fixed version

2.0.0

Patch status

Patched

Published

2026-09-13T00:17:07.203

Modified

2026-09-13T00:17:07.203

Why it matters

This matters because the affected product may allow code execution. Prioritize systems that are internet-facing or have privileged access to other infrastructure.

Recommended admin actions

• Review and patch based on exposure, asset criticality, and business impact.
• Compare installed versions against the affected version range in the advisory.
• Review logs for suspicious activity related to the affected application or component.

Technical summary

Socket Firewall (socketdev/socket-registry-firewall) in registry mode before 2.0.0 does not verify upstream TLS certificates by default. When the api_ssl_verify and upstream_ssl_verify configuration keys are omitted from socket.yml, the generated configuration sets SOCKET_API_SSL_VERIFY='false' and UPSTREAM_SSL_VERIFY='false', and the OpenResty/Lua HTTP client used for outbound requests accepts any certificate, including self-signed and otherwise untrusted certificates, without validating the chain. An attacker positioned to intercept traffic between Socket Firewall and the Socket API or an upstream package registry can present a crafted certificate and modify responses in transit, including substituting malicious package content or altering the allow/block decisions the firewall enforces. Setting api_ssl_verify: true and upstream_ssl_verify: true enables verification; however, in versions before 1.1.334, the generated nginx configuration did not emit lua_ssl_trusted_certificate, and thus verification could not be used successfully without manually patching the generated configuration. Version 2.0.0 changes the default for both settings to true.

View the official NVD record for CVE-2026-90651

CVE data is sourced from NVD/CNA records and optional enrichment. Validate against the vendor advisory before taking production action.