CVE-2025-41256

Cyberduck and Mountain Duck improper handle TLS certificate pinning for untrusted certificates (e.g., self-signed), since the certificate fingerprint is stored as SHA-1, although SHA-1 is considered weak. This issue affects Cyberduck: through 9.1.6; Mountain Duck: through 4.17.5.

Scoring

Severity

HIGH

CVSS base score

7.4

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

EPSS probability

0.11%

CWE

CWE-328

Published

2025-06-25

Last modified

2026-03-12

Affected products

• iterate GmbH Cyberduck
• iterate GmbH Mountain Duck

Weakness type

• CWE-328

Related vulnerabilities

• CVE-2026-15605 — wandb Artifact Integrity Validation hashutil.py ArtifactManifestEntry.download weak hash
• CVE-2026-41879 — Weak password hashing in R-SOFT DMS
• CVE-2026-14742 — langchain-ai langgraph Task Result Cache _cache.py _freeze weak hash
• CVE-2026-14738 — exo-explore exo Vision Feature Cache vision.py _image_cache_key weak hash
• CVE-2026-14630 — ForceInjection AI-fundermentals Memory Recall smart_customer_service.py get_conversation_history weak hash
• CVE-2026-10540 — Weak password hash protection in Control-M/Entreprise Manager
• CVE-2026-13455 — PostgreSQL Anonymizer: Unrestricted function can leak the secret salt
• CVE-2026-53692 — Weak hashing algorithm in Redeight CMS

Markdown version · Browse all CVEs