AIKIDO-2026-737023

TL;DR

Before the fix, rack-proxy disabled TLS certificate verification by default for HTTPS backends by using OpenSSL::SSL::VERIFY_NONE, which made backend connections vulnerable to man-in-the-middle attacks. Although the :ssl_verify_none option existed, it was effectively ignored, so insecure behavior happened silently unless :verify_mode was explicitly set. The fix changes the default to OpenSSL::SSL::VERIFY_PEER, properly honors :ssl_verify_none as an explicit opt-out, and gives :verify_mode precedence for clear control. An attacker able to intercept traffic between rack-proxy and its HTTPS backend could exploit this by presenting a forged certificate, impersonating the backend server, and reading or modifying proxied requests and responses.