CVE-2026-105222: Google Maps Laravel Package TLS Vulnerability

CVE-2026-105222 is an information disclosure vulnerability in the alexpechkarev/google-maps Laravel package that disables TLS certificate verification by default. This allows attackers to intercept API keys and tamper with responses. This article covers the technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2026-105222 Overview

The alexpechkarev/google-maps Laravel package through version 12.16 disables Transport Layer Security (TLS) certificate verification by default. The bundled configuration file sets ssl_verify_peer to FALSE, which is passed directly to the cURL option CURLOPT_SSL_VERIFYPEER. On-path attackers can present any certificate to intercept Google Maps web-service requests issued by the application. Attackers can steal the API key embedded in the request query string and tamper with returned data. This weakness is classified as improper certificate validation [CWE-295].

Critical Impact
Any network-positioned attacker between the application and Google Maps APIs can intercept traffic, exfiltrate the Google Maps API key, and manipulate geocoding, directions, and places responses returned to the application.

Affected Products

alexpechkarev/google-maps Laravel package versions up to and including 12.16
Laravel applications depending on the vulnerable package through Composer
Downstream services relying on untampered Google Maps API responses

Discovery Timeline

2026-10-04 - CVE-2026-105222 published to the National Vulnerability Database
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-105222

Vulnerability Analysis

The package issues outbound HTTPS requests to Google Maps web services using PHP's cURL extension. The default configuration shipped with the package explicitly disables peer certificate verification. Because CURLOPT_SSL_VERIFYPEER is set to false, cURL does not validate the server certificate chain against trusted certificate authorities. The TLS handshake completes with any certificate, including self-signed or attacker-controlled certificates. Developers installing the package via Composer inherit this insecure default without warning.

Root Cause

The root cause is an insecure default configuration value in src/config/googlemaps.php. The ssl_verify_peer option is set to FALSE and consumed by the WebService client at src/WebService.php lines 267-269. The client forwards the value directly to cURL without enforcing a safe baseline. This violates the secure-by-default principle for a networking library that transports authentication material. See the GitHub configuration file and the GitHub source code snippet for the exact code paths.

Attack Vector

An attacker who controls any network hop between the Laravel application and maps.googleapis.com can mount a machine-in-the-middle attack. This includes rogue Wi-Fi operators, compromised upstream routers, malicious proxies, or hostile cloud network overlays. The attacker terminates TLS with a self-signed certificate, captures the full request URL containing the key query parameter, and relays modified responses. Harvested API keys enable billing abuse and quota exhaustion against the victim's Google Cloud project. Tampered responses can mislead downstream application logic that relies on geocoding or routing data.

For technical details, see the VulnCheck Security Advisory and the GitHub Issue Tracker.

Detection Methods for CVE-2026-105222

Indicators of Compromise

Outbound HTTPS connections to maps.googleapis.com presenting certificates not chained to a public certificate authority.
Unexpected Google Cloud billing spikes or quota exhaustion on API keys scoped to the Maps Platform.
Google Maps API responses with checksums or field values inconsistent across repeated requests for the same input.

Detection Strategies

Perform a Composer dependency audit for alexpechkarev/google-maps at or below version 12.16 across all Laravel projects.
Review config/googlemaps.php in deployed applications for ssl_verify_peer => false.
Inspect application-level cURL instrumentation for calls that set CURLOPT_SSL_VERIFYPEER to a falsy value.

Monitoring Recommendations

Monitor egress TLS inspection logs for Google Maps endpoints and flag unexpected certificate issuers.
Alert on anomalous usage patterns or geographic origin changes for Google Maps API keys in Google Cloud audit logs.
Track outbound requests from Laravel application servers to Google APIs and baseline certificate fingerprints.

How to Mitigate CVE-2026-105222

Immediate Actions Required

Set ssl_verify_peer to true in the published config/googlemaps.php file for every affected application.
Rotate any Google Maps API keys that were used by vulnerable deployments and restrict them by HTTP referrer, IP, or application identifier in the Google Cloud console.
Audit Composer lockfiles across the organization to identify every project pulling alexpechkarev/google-maps.

Patch Information

At the time of publication, no fixed upstream release is referenced in the advisory data for versions above 12.16. Track the GitHub Project Repository and the GitHub Issue Tracker for an official patched release. Until a patched version ships, override the insecure default in application configuration.

Workarounds

Publish and edit the package configuration so that ssl_verify_peer is explicitly true before deploying to production.
Enforce TLS inspection and certificate pinning at the egress proxy for traffic destined to maps.googleapis.com.
Replace query-string API key transport with server-side key brokering so credentials are not exposed to on-path observers if verification regresses.

bash

# Configuration example: force TLS verification in config/googlemaps.php
# After running: php artisan vendor:publish --tag=googlemaps
# Edit config/googlemaps.php and set:
'ssl_verify_peer' => true,

# Verify no insecure defaults remain across the codebase
grep -rn "ssl_verify_peer" config/ vendor/alexpechkarev/
grep -rn "CURLOPT_SSL_VERIFYPEER" vendor/alexpechkarev/