OpenList Frontend contains a default configuration that disables TLS certificate verification for all storage driver traffic prior to version 4.1.10. This flaw, a case of CWE‑599, lets an attacker launch a man‑in‑the‑middle attack by redirecting traffic through a malicious endpoint. With verification turned off, the application accepts any TLS certificate, allowing full decryption, data theft, and manipulation of storage operations while evading normal security alerts.

OpenListTeam OpenList version 4.1.9 and earlier are affected, specifically any deployment using the default configuration that leaves TlsInsecureSkipVerify set to true. The vulnerability applies to all environments where the frontend communicates with storage drivers over TLS, such as internal networks, Wi‑Fi hotspots, or compromised network devices.

With a CVSS score of 8.1, the vulnerability ranks as high severity. The low EPSS indicates exploit probability is currently small, and the issue is not yet cataloged in KEV, suggesting limited public exploitation. However, once an attacker can manipulate network paths, the lack of certificate validation makes it trivial for an adversary to forge certificates and control traffic between the OpenList instance and its storage backends.