CVE-2026-50010: Netty's wrapping plain trust manager silently disables hostname verification

Synopsis

This is an authentication-bypass class vulnerability in Netty, the Java network application framework. It is reachable over the network with no authentication required, and affects any TLS client built with a plain X509TrustManager via SslContextBuilder. Successful exploitation allows an attacker positioned between the client and server to impersonate any TLS endpoint, intercepting encrypted traffic because hostname verification is silently disabled. No fix versions have been published yet; HarborGuard is tracking the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be positioned on the network path between the Netty TLS client and its intended server to intercept or impersonate the connection.

• AuthenticationNot required

  No authentication is needed; the vulnerability is exploitable by any network-positioned party without credentials.

• Victim interactionNot required

  No user interaction is required; the client silently skips hostname verification on every outbound TLS handshake.

• Attack complexityDetail

  Attack complexity is low, meaning no race conditions or special environmental conditions are needed; any attacker with a valid network position can reliably exploit the missing hostname check.

Blast Radius

• An attacker impersonates any TLS server the affected Netty client connects to, because hostname verification is not performed.
• All data transmitted over the intercepted TLS session is exposed in plaintext to the attacker, including credentials, session tokens, and application payloads.
• The attacker can read responses sent back to the client, enabling exfiltration of server-side data returned over the hijacked connection.