# CVE-2026-106036: Szafir improper certificate validation in HTTPS connections

Source: https://junglewise.ai/threats/cve-2026-106036-szafir-accepts-any-client-or-server-certificate-without  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-29. Updated: 2026-10-29  
License: CC BY 4.0 with a link back

CVE-2026-106036 · Severity: info · Published 2026-10-29

Szafir is a digital signature and certification software used for electronic documents and authentication in Poland. The application fails to validate SSL/TLS certificates and hostnames, allowing an attacker to intercept HTTPS connections and pose as a legitimate server. An attacker can trick the application into downloading malicious update files, potentially compromising the system or stealing sensitive data.

Technologies: [Krajowa Izba Rozliczeniowa Szafir](https://junglewise.ai/threats/technologies/szafir). Vendors: [Krajowa Izba Rozliczeniowa](https://junglewise.ai/threats/vendors/krajowa-izba-rozliczeniowa).

## Quick answers

**Is CVE-2026-106036 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-106036 being exploited in the wild.

**How severe is CVE-2026-106036?** Informational severity, published 29 October 2026.

**Which products and versions are affected?** Krajowa Izba Rozliczeniowa Szafir All versions up to 2.0 build 708.

**Is there a fix for CVE-2026-106036?** Yes: fixed in 2.0 build 708. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-106036 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-106036?** Check whether you run Krajowa Izba Rozliczeniowa Szafir at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 2.0 build 708

## Technical details

The vulnerability is an improper certificate validation flaw (CWE-295) where Szafir accepts any client or server certificate without performing certificate chain verification or hostname validation. An attacker positioned to intercept HTTPS traffic (e.g., man-in-the-middle) can provide an arbitrary SSL/TLS certificate and redirect update requests to a malicious server. The issue is fixed in version 2.0 build 708.

## Affected products

- Krajowa Izba Rozliczeniowa Szafir All versions up to 2.0 build 708

## Timeline

- 2026-10-29: disclosed

## References

- [https://cert.pl/posts/2026/10/CVE-2026-93570](https://cert.pl/posts/2026/10/CVE-2026-93570)
- [https://www.elektronicznypodpis.pl/](https://www.elektronicznypodpis.pl/)

## Related threats

- [Szafir path traversal in update filename handling](https://junglewise.ai/threats/cve-2026-93571-szafir-is-vulnerable-to-path-traversal-in-the-uploaded-filename-a)
- [Szafir XML External Entity injection in XML signing](https://junglewise.ai/threats/cve-2026-93570-szafir-and-szafir-weryfikujaca-are-vulnerable-to-xml-external)