req_llm WebSocket client disables TLS certificate verification

critical severity · published 2026-10-23

An attacker on the same network path can read and modify OpenAI WebSocket sessions, including stealing the authorization bearer token. The client connects with TLS certificate verification turned off and drops caller-supplied certificate options.

Fixed in: 1.29.0

CVE: CVE-2026-107685

Source: NVD

Am I affected?

You are affected if the installed version is older than 1.29.0. Check the version you have and update to 1.29.0 or later. The fixed version is verified against a vendor or advisory source.

Get the fix

FixLane has a reviewed fix procedure for this incident: a read-only check first, then the fix. Ask the Telegram bot, or connect an AI agent to the FixLane MCP server and call get_fix_prompt with incident id 517 and your operating system.