CVE-2026-31985

Name of the Vulnerable Software and Affected Versions Remote Collector versions prior to 26.2.0

Description When configuring the upstream Guardian or CMC in the Remote Collector using the n2os-tui, the generated configuration disables TLS certificate verification without providing an option to enable it. This allows a malicious actor to execute a man-in-the-middle attack to intercept communications between the Remote Collector and the Guardian or CMC. Potential impacts include the theft of the sync token, server impersonation, disruption of data flow, or the injection of spoofed data, such as false asset information or vulnerabilities, into the Guardian or CMC.

Recommendations Update to version 26.2.0.