ChangeIntel IT change radar

Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-105218

gopay before 1.5.119 Disabled TLS Certificate Verification in xhttp Client

CVSS 4.0 9.1 CRITICALCVSS 3.1 7.4 HIGHCheck source for fixed versionsKEV status unknown

Original advisory

Historical advisory recorded 23 Oct 2026 15:48:27 UTC. Read the latest advisory.

cve-program · CVE-2026-105218

Published

gopay before 1.5.119 disables TLS certificate verification in defaultClient() in pkg/xhttp/client.go, allowing man-in-the-middle attackers to impersonate payment provider APIs. Attackers can present any certificate to read merchant credentials, signatures and transaction data, and modify payment, refund and order query responses.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-105218

Published

gopay

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "go-pay",
                    "product": "gopay",
                    "defaultStatus": "unaffected",
                    "packageURL": "pkg:golang/github.com/go-pay/gopay",
                    "versions": [
                        {
                            "version": "0",
                            "lessThan": "1.5.119",
                            "status": "affected",
                            "versionType": "semver"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON