CVE-2026-35207: Deepin Desktop Environment Info Disclosure

CVE-2026-35207 Overview

CVE-2026-35207 is an improper certificate validation vulnerability [CWE-295] in dde-control-center, the control panel for the Deepin Desktop Environment (DDE). The flaw resides in the plugin-deepinid component, which provides the deepinid cloud service integration. Prior to version 6.1.80, the plugin skips TLS certificate verification when fetching user avatars from openapi.deepin.com and other providers.

A network-positioned attacker can intercept the HTTPS traffic, substitute the avatar image with malicious or misleading content, and correlate avatars to identify users. The vulnerability is fixed in dde-control-center versions 6.1.80 and 5.9.9.

Critical Impact

Machine-in-the-middle attackers on the network path can manipulate avatar content delivered to Deepin desktop users and conduct user identification through observed avatar responses.

Affected Products

• dde-control-center versions prior to 6.1.80 (6.x branch)
• dde-control-center versions prior to 5.9.9 (5.x branch)
• plugin-deepinid component within affected dde-control-center releases

Discovery Timeline

• 2026-04-09 - CVE-2026-35207 published to NVD
• 2026-04-13 - Last updated in NVD database

Technical Details for CVE-2026-35207

Vulnerability Analysis

The plugin-deepinid module within dde-control-center issues HTTPS requests to retrieve the authenticated user's profile avatar from openapi.deepin.com and related Deepin endpoints. The HTTP client used for these requests is configured to ignore TLS certificate validation errors. This means the client accepts any presented certificate, including self-signed certificates or certificates signed by attacker-controlled certificate authorities.

An attacker on the same network segment, an upstream router, or a hostile Wi-Fi access point can present a forged certificate for openapi.deepin.com. The plugin completes the TLS handshake and downloads attacker-supplied image data. The attacker can also observe which avatar URLs are requested, enabling user identification by correlating responses with known accounts.

The weakness aligns with CWE-295 (Improper Certificate Validation). Exploitation requires user interaction in the form of the user signing in to or refreshing the deepinid panel, which triggers the avatar fetch.

Root Cause

The networking code in plugin-deepinid explicitly disabled TLS peer verification on the request handler used for avatar retrieval. The upstream fix in pull request #3146 restores certificate validation for these requests. Commits 6fc206120be28d9eef7d72258662bcabb834367f and cd95b054ff10a35bc9284431631305bd56244b3d contain the remediation.

Attack Vector

Exploitation is performed over the network with low attack complexity and no authentication required. The attacker must occupy a position capable of intercepting the victim's HTTPS traffic, such as a shared LAN, a malicious Wi-Fi hotspot, a compromised intermediate router, or an ISP-level adversary. After interception, the attacker terminates the TLS connection with a forged certificate, returns a crafted image payload, and optionally logs request metadata to identify the user.

No proof-of-concept exploit is publicly available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The vulnerability mechanism is described in prose only; see the GitHub Security Advisory for the maintainers' technical write-up.

Detection Methods for CVE-2026-35207

Indicators of Compromise

• Unexpected TLS certificates presented for openapi.deepin.com that are not issued by the legitimate certificate authority chain.
• Avatar images displayed in the deepinid control center panel that do not match the user's known profile picture.
• Outbound HTTPS connections from dde-control-center processes to non-Deepin IP addresses or proxy endpoints.

Detection Strategies

• Inspect installed dde-control-center package versions on Deepin and downstream distributions to identify hosts running releases earlier than 6.1.80 or 5.9.9.
• Use network monitoring to flag TLS sessions to openapi.deepin.com that terminate with certificates outside the expected issuer set.
• Review process telemetry for dde-control-center network connections to atypical destinations correlated with deepinid login activity.

Monitoring Recommendations

• Enable certificate transparency monitoring for Deepin-operated domains and alert on unexpected issuance events.
• Log and retain DNS resolutions and outbound destinations for endpoints running Deepin desktops to support incident review.
• Track package inventory across Linux endpoints to confirm timely uptake of the fixed dde-control-center versions.

How to Mitigate CVE-2026-35207

Immediate Actions Required

• Upgrade dde-control-center to version 6.1.80 (6.x branch) or 5.9.9 (5.x branch) on all Deepin endpoints.
• Advise users to avoid signing in to deepinid services from untrusted networks until patching is complete.
• Audit Linux endpoint inventories for Deepin Desktop Environment installations that may have been overlooked.

Patch Information

The maintainers released fixes in dde-control-center 6.1.80 and 5.9.9. The remediation re-enables TLS certificate verification on the avatar fetch path. Review the GitHub Pull Request #3146 and the corresponding commits 6fc20612 and cd95b054 for the exact code changes.

Workarounds

• Route Deepin endpoint traffic through a trusted VPN to reduce exposure to local network adversaries until patches are applied.
• Restrict use of the deepinid plugin in dde-control-center on hosts where upgrading is not immediately feasible.
• Block outbound access to deepinid endpoints at the network perimeter on systems that do not require cloud account features.

# Verify the installed dde-control-center version on Debian/Deepin-based systems
dpkg -l | grep dde-control-center

# Upgrade after the fixed package is available in your distribution repository
sudo apt update && sudo apt install --only-upgrade dde-control-center