What’s Vulnerable › Vulnerabilities

CVE-2026-105218: gopay before 1.5.119 Disabled TLS Certificate Verification in xhttp Client

• Severity: high (CVSS 7.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-04 · updated 2026-10-06
• Weakness: CWE-295

Description

gopay before 1.5.119 disables TLS certificate verification in defaultClient() in pkg/xhttp/client.go, allowing man-in-the-middle attackers to impersonate payment provider APIs. Attackers can present any certificate to read merchant credentials, signatures and transaction data, and modify payment, refund and order query responses.

Affected products

• go-pay gopay: before 1.5.119 — fixed in 1.5.119

How to fix

Upgrade to a fixed version: go-pay gopay 1.5.119. Check the vendor advisory for mitigations.

References

• https://github.com/go-pay/gopay
• https://github.com/go-pay/gopay/blob/v1.5.118/pkg/xhttp/client.go#L15-L37
• https://github.com/go-pay/gopay/commit/f6df04fd4f64a2ad2c303ba063b6502bfdd259fd
• https://github.com/go-pay/gopay/issues/540
• https://www.vulncheck.com/advisories/gopay-before-1.5.119-disabled-tls-certificate-verification-in-xhttp-client

Get alerted when CVE-2026-105218 or the next vulnerability affects your stack