When no CA path is provided via --ca, SSL_CTX_set_verify(ctx, SSL_VERIFY_NONE, NULL) disables all certificate verification (transport_tls.c:82). While X509_VERIFY_PARAM_set1_host() is called for SNI, without SSL_VERIFY_PEER the certificate chain is never validated, so MITM attacks are trivial. There is no --insecure flag to explicitly opt into this.
Location
src/shared/transport_tls.c:77-83
How to trigger
Connect to a TLS server without providing --ca. The client will connect to any server presenting any certificate, including self-signed or fraudulent ones. A MITM attacker between client and server can intercept all data.
Suggested Fix
By default, use the system CA store via SSL_CTX_set_default_verify_paths(ctx)
Only disable verification with an explicit --insecure flag (which currently does not exist)
When --ca is provided, use it and enforce SSL_VERIFY_PEER
Severity
medium
Category
security
Sub-Agent
security-screener (SC-7)
This issue was automatically generated by the issue-creator agent.
## Description
When no CA path is provided via `--ca`, `SSL_CTX_set_verify(ctx, SSL_VERIFY_NONE, NULL)` disables all certificate verification (transport_tls.c:82). While `X509_VERIFY_PARAM_set1_host()` is called for SNI, without `SSL_VERIFY_PEER` the certificate chain is never validated, so MITM attacks are trivial. There is no `--insecure` flag to explicitly opt into this.
## Location
src/shared/transport_tls.c:77-83
## How to trigger
Connect to a TLS server without providing `--ca`. The client will connect to any server presenting any certificate, including self-signed or fraudulent ones. A MITM attacker between client and server can intercept all data.
## Suggested Fix
1. By default, use the system CA store via `SSL_CTX_set_default_verify_paths(ctx)`
2. Only disable verification with an explicit `--insecure` flag (which currently does not exist)
3. When `--ca` is provided, use it and enforce `SSL_VERIFY_PEER`
## Severity
medium
## Category
security
## Sub-Agent
security-screener (SC-7)
---
_This issue was automatically generated by the issue-creator agent._
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Description
When no CA path is provided via
--ca,SSL_CTX_set_verify(ctx, SSL_VERIFY_NONE, NULL)disables all certificate verification (transport_tls.c:82). WhileX509_VERIFY_PARAM_set1_host()is called for SNI, withoutSSL_VERIFY_PEERthe certificate chain is never validated, so MITM attacks are trivial. There is no--insecureflag to explicitly opt into this.Location
src/shared/transport_tls.c:77-83
How to trigger
Connect to a TLS server without providing
--ca. The client will connect to any server presenting any certificate, including self-signed or fraudulent ones. A MITM attacker between client and server can intercept all data.Suggested Fix
SSL_CTX_set_default_verify_paths(ctx)--insecureflag (which currently does not exist)--cais provided, use it and enforceSSL_VERIFY_PEERSeverity
medium
Category
security
Sub-Agent
security-screener (SC-7)
This issue was automatically generated by the issue-creator agent.
Fixed in PR #148 — merged into main on 2026-07-29. See #148