External risk intelligence

Laravel Google Maps Package Disabled TLS Verification

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-105222

The vulnerability affects a library used for server-side integration with external web services. While such libraries are often used in public-facing web applications, the vulnerability lies in the backend processing of outgoing API requests rather than an exposed management interface or edge service itself, making internet-facing exploitation contingent on specific application logic.

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in the alexpechkarev/google-maps Laravel package allows attackers to intercept Google Maps web service requests. This could lead to the exposure of API keys and manipulation of responses, potentially impacting services that rely on these integrations.

Insecure default configuration allows data interception.
Affects services using Google Maps API keys.
Confirm package relevance and exposure.

Attack Path

How an attacker could exploit the issue

Attackers on the same network can intercept traffic to Google Maps web services. This is because the package's default configuration disables TLS certificate verification, allowing attackers to present a fake certificate. By doing so, they can steal API keys from request parameters and alter the responses received.

Requires network access.
Triggers via intercepted API requests.
Leads to API key theft and response tampering.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, on-path attackers could intercept Google Maps web service requests, potentially exposing API keys and enabling response tampering. This occurs because the bundled configuration in the alexpechkarev/google-maps Laravel package, through version 12.16, disables TLS certificate verification by default.

API keys and service requests.
Network attackers intercepting traffic.
Compromised API key and data manipulation.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts applications using the alexpechkarev/google-maps Laravel package, potentially exposing API keys and allowing response tampering. The primary responsibility likely falls to application owners and infrastructure teams to identify deployments, assess business criticality and exposure, and coordinate remediation efforts, possibly involving vendor management if the package is a third-party component. The first practical step is to locate all instances of the affected package, determine their reachability and importance, and assign an accountable owner for planning a fix, which may require vendor coordination or the implementation of temporary risk-reduction measures.

Application owners and infrastructure teams.
Identify affected deployments and business criticality.
Plan remediation or temporary risk reduction.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the alexpechkarev/google-maps package?

It is a PHP library for the Laravel framework that simplifies communication with Google Maps web services. Developers use it to integrate mapping, geocoding, and routing features directly into their web applications by handling the API request lifecycle and response parsing automatically.

How does CVE-2026-105222 undermine security?

This vulnerability, classified as CWE-295 (Improper Certificate Validation), occurs because the package disables TLS certificate verification by default. By instructing the system to ignore certificate authenticity, the software cannot confirm it is talking to Google, leaving the encrypted connection open to interception.

Do I need to be directly attacked for this to work?

Yes. This bug is triggered when an attacker is positioned on the same network path between your server and the Google Maps API. It does not trigger if your traffic is encrypted end-to-end via other mechanisms or if the attacker lacks the network positioning required to intercept and impersonate the server's traffic.

Why should I care about this library vulnerability?

Halo Surface Signal notes that while this affects backend API processing, many applications using this package are public-facing. If an attacker intercepts these requests, they can steal your Google Maps API keys or manipulate the map data your application displays to users, potentially impacting application integrity.

How do I start responding to this CVE?

Begin by inventorying your applications to identify which instances rely on the alexpechkarev/google-maps package. Once located, assess the business criticality of those specific services and coordinate with your technical teams to confirm the current configuration and prioritize updates or security adjustments.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.