Vulnerability · Published Oct 5, 2026 · Assigned by VulnCheck

CVE-2026-105295GitAhead 2.5.0 through 2.7.1 Unverified Update Installation and TLS Bypass

High 7.5

In plain English

A high-severity security flaw in GitAhead from gitahead. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 2% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.1%top 97.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

GitAhead 2.5.0 through 2.7.1 contains an insecure update mechanism that installs downloaded updates without integrity or signature verification and permanently ignores TLS errors after one SSL error dialog. Network attackers presenting an invalid certificate once can intercept later automatic update checks, offer a fake version, and execute code as the user upon installation.

Affected products (as reported)

Vendor	Product	Versions
gitahead	GitAhead	2.5.0 – through 2.7.1

Weakness: CWE-494 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

References

GitHub Issue #662 issue-tracking
https://github.com/gitahead/gitahead product
https://github.com/gitahead/gitahead/blob/v2.7.1/src/update/Updater.cpp#L176-L279 technical-description
https://github.com/gitahead/gitahead/blob/v2.7.1/src/app/Application.cpp#L284-L309 technical-description
VulnCheck Advisory: GitAhead 2.5.0 through 2.7.1 Unverified Update Installation and TLS Bypass third-party-advisory