External risk intelligence

Galaxy FDS Android SDK TLS Hostname Verification Disabled Enables Man-in-the-Middle Attacks

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-26214

This vulnerability exists within an Android SDK library used by mobile applications. It is a client-side library issue that depends on the implementation within a specific application, rather than a standalone network service or appliance. It does not represent a public-facing infrastructure service or a network-reachable component that can be targeted directly from the internet.

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability affects an Android software development kit, allowing attackers to intercept and alter communications with cloud storage by bypassing security checks. This could expose sensitive information and credentials. The affected software is no longer supported by its vendor.

SDK flaws let attackers spy on data.
Old code can still be a hidden risk.
Confirm if our apps use this unsupported SDK.

Attack Path

How an attacker could exploit the issue

An attacker could intercept and alter communications between an app using the affected SDK and cloud storage by performing a man-in-the-middle attack. This is possible because the SDK improperly handles TLS hostname verification, allowing it to connect to servers with mismatched hostnames. When used with its default settings, the SDK is vulnerable, potentially exposing sensitive data.

No specific user interaction required.
Man-in-the-middle attack intercepts traffic.
Risk of credential and data exposure.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, this vulnerability could allow a man-in-the-middle attacker to intercept and modify communications with cloud storage endpoints. This may expose authentication credentials and file contents.

Cloud storage credentials and file contents.
Intercepting and modifying network communications.
Exposure of sensitive information.

Operational Fix

Recommended remediation, mitigation, and detection steps

Given that the affected Android SDK is end-of-life, primary responsibility likely falls to application owners to identify and remediate deployments, with support from vendor management if third-party applications are impacted. The first practical step is to inventory all applications utilizing the SDK, assess their reachability and criticality, and then prioritize remediation efforts, potentially through application updates or decommissioning.

Application owners should coordinate remediation.
Verify SDK usage across all applications.
Plan for app updates or decommissioning.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Galaxy FDS Android SDK?

The Galaxy FDS Android SDK is a software toolkit used by developers to integrate Xiaomi's File Data Storage (FDS) cloud services into Android applications. It provides the necessary functions to upload, manage, and retrieve files stored on the FDS platform. Because it is a client-side library, the functionality it enables is embedded directly within the app itself, rather than existing as an independent, standalone service or server.

Why does CVE-2026-26214 cause a security risk?

This vulnerability is classified as CWE-297, which involves improper validation of certificate hostnames. In this SDK, the software is configured to ignore whether the TLS certificate presented by a server matches the expected hostname. This weakness breaks the chain of trust required for secure HTTPS communication, allowing an attacker positioned in the network path to impersonate the legitimate cloud storage server.

How does a man-in-the-middle attack trigger this flaw?

An attacker triggers this by intercepting the network traffic between an affected app and the storage endpoint. Because the SDK accepts any valid certificate—even if it belongs to the attacker—the app mistakenly believes it has established a secure connection. This flaw is inherent when using default SDK settings; the bug is not triggered by specific user actions, but rather by the fundamental failure to verify server identity during the initial handshake.

Is my organization affected by this CVE?

Halo Surface Signal indicates that this issue is unlikely to appear as a public-facing infrastructure service. Since this is a library embedded inside mobile applications, the risk is localized to the specific apps using the SDK. You should be concerned if your internal teams have built or maintain custom Android applications that rely on this specific, end-of-life SDK to handle sensitive cloud storage data.

What should I do if my apps use this SDK?

Since the project is officially end-of-life, there will be no official patch from the vendor. Your first step is to perform an inventory of all mobile applications to identify those using this SDK. Once identified, prioritize replacing the library with a supported alternative. If immediate removal is not possible, evaluate the sensitivity of the data handled by the app and consider restricting network access as a temporary mitigation until the code can be updated or decommissioned.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.