Which versions of Apache are affected by CVE-2026-26214?

Xiaomi Galaxy FDS Android SDK (version 3.0.8 and prior) contains a critical vulnerability that allows attackers on corporate or public networks to intercept and steal authentication credentials and…

How to fix or mitigate CVE-2026-26214?

Within 24 hours, conduct a software inventory audit to identify all applications deployed in production using Xiaomi Galaxy FDS SDK version 3.0.8 or earlier and classify by criticality based on the sensitivity of data they handle. Within 7 days, develop and begin executing a migration plan to either upgrade to a patched version or replace with alternative SDKs that properly validate TLS certificates. Within 30 days, implement enhanced network monitoring and segmentation to restrict deployment of applications using the vulnerable SDK to trusted networks only, while prioritizing accelerated migration as the primary remediation.

Apache CVE-2026-26214

Q: What is the CVSS score of CVE-2026-26214?

CVE-2026-26214 has a CVSS 4.0 base score of 9.1 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

CRITICAL

Improper Validation of Certificate with Host Mismatch (CWE-297)

2026-02-12 disclosure@vulncheck.com

Apache Google Information Disclosure

9.1

CVSS 4.0 · Vendor: vulncheck

Severity by source

Vendor (vulncheck) PRIMARY

9.1 CRITICAL

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (vulncheck) · only source for this CVE.

CVSS VectorVendor: vulncheck

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jul 14, 2026 - 16:40 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 14, 2026 - 16:22 vuln.today

cvss_changed

Severity Changed

Jul 14, 2026 - 16:22 NVD

HIGH CRITICAL

CVSS changed

Jul 14, 2026 - 16:22 NVD

7.4 (HIGH) 9.1 (CRITICAL)

Analysis Generated

Mar 12, 2026 - 22:02 vuln.today

CVE Published

Feb 12, 2026 - 16:16 nvd

HIGH 7.4

DescriptionCVE.org

Galaxy FDS Android SDK (XiaoMi/galaxy-fds-sdk-android) version 3.0.8 and prior disable TLS hostname verification when HTTPS is enabled (the default configuration). In GalaxyFDSClientImpl.createHttpClient(), the SDK configures Apache HttpClient with SSLSocketFactory.ALLOW_ALL_HOSTNAME_VERIFIER, which accepts any valid TLS certificate regardless of hostname mismatch. Because HTTPS is enabled by default in FDSClientConfiguration, all applications using the SDK with default settings are affected. This vulnerability allows a man-in-the-middle attacker to intercept and modify SDK communications to Xiaomi FDS cloud storage endpoints, potentially exposing authentication credentials, file contents, and API responses. The XiaoMi/galaxy-fds-sdk-android open source project has reached end-of-life status.

AnalysisAI

Man-in-the-middle interception affects the Xiaomi Galaxy FDS Android SDK (galaxy-fds-sdk-android) version 3.0.8 and prior, which disables TLS hostname verification whenever HTTPS is enabled — the default. Because createHttpClient() installs Apache HttpClient's ALLOW_ALL_HOSTNAME_VERIFIER, any TLS certificate from any host is accepted, letting an on-path attacker impersonate Xiaomi FDS cloud storage endpoints and steal authentication credentials, file contents, and API responses. EPSS is very low (0.03%, 8th percentile) and there is no public exploit identified at time of analysis, but the project has reached end-of-life so no fix is expected.