← Back to CVE Explorer

CVE-2026-42789

Full vulnerability record from the local CVENow database.

Description

Improper Following of a Certificate's Chain of Trust vulnerability in Erlang OTP public_key (pubkey_cert module) allows a non-CA certificate to be accepted as an intermediate issuer, enabling certificate chain forgery. In lib/public_key/src/pubkey_cert.erl, pubkey_cert:validate_extensions/7 contains two flaws that together allow a certificate with basicConstraints cA:false and no keyUsage extension to be used as an intermediate issuer in a chain passed to public_key:pkix_path_validation/3: the cA:false clause recurses into the remaining extensions without rejecting the certificate when it is in issuer position, and the keyUsage check only fires when the extension is present, so a certificate lacking keyUsage entirely bypasses the keyCertSign enforcement. Any party holding an end-entity certificate with basicConstraints cA:false and no keyUsage extension, issued by any CA in the victim's trust store, can use that certificate's private key to sign forged leaf certificates for arbitrary identities. public_key:pkix_path_validation/3 accepts the resulting chain, and by extension every TLS or mTLS endpoint built on the OTP ssl application that relies on the default verifier is affected, including server identity verification on the client side and client certificate verification on mTLS servers. This issue affects OTP from OTP 17.0 before OTP 27.3.4.19, OTP 28.5.0.8, and OTP 29.1.2, corresponding to public_key from 0.22 before 1.17.1.7, 1.20.3.6, and 1.21.8. Whether OTP before OTP 17.0, corresponding to public_key before 0.22, is affected is unknown.

Severity
HIGH
CVSS score
7.0 (v4.0)
Vulnerability status
Modified
Source identifier
6b3ad84c-e1a6-4bf7-a703-f496b71e49db
Published
2026-05-27 14:16:53.267000
Last modified
2026-10-26 11:10:00.157000
View original CVE JSON 
{
  "id": "CVE-2026-42789",
  "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
  "published": "2026-05-27T14:16:53.267",
  "lastModified": "2026-10-26T11:10:00.157",
  "vulnStatus": "Modified",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper Following of a Certificate's Chain of Trust vulnerability in Erlang OTP public_key (pubkey_cert module) allows a non-CA certificate to be accepted as an intermediate issuer, enabling certificate chain forgery.\n\nIn lib/public_key/src/pubkey_cert.erl, pubkey_cert:validate_extensions/7 contains two flaws that together allow a certificate with basicConstraints cA:false and no keyUsage extension to be used as an intermediate issuer in a chain passed to public_key:pkix_path_validation/3: the cA:false clause recurses into the remaining extensions without rejecting the certificate when it is in issuer position, and the keyUsage check only fires when the extension is present, so a certificate lacking keyUsage entirely bypasses the keyCertSign enforcement.\n\nAny party holding an end-entity certificate with basicConstraints cA:false and no keyUsage extension, issued by any CA in the victim's trust store, can use that certificate's private key to sign forged leaf certificates for arbitrary identities. public_key:pkix_path_validation/3 accepts the resulting chain, and by extension every TLS or mTLS endpoint built on the OTP ssl application that relies on the default verifier is affected, including server identity verification on the client side and client certificate verification on mTLS servers.\n\nThis issue affects OTP from OTP 17.0 before OTP 27.3.4.19, OTP 28.5.0.8, and OTP 29.1.2, corresponding to public_key from 0.22 before 1.17.1.7, 1.20.3.6, and 1.21.8. Whether OTP before OTP 17.0, corresponding to public_key before 0.22, is affected is unknown."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de seguimiento incorrecto de la cadena de confianza de un certificado en Erlang OTP public_key (módulo pubkey_cert) permite que un certificado que no es de CA sea aceptado como emisor intermedio, lo que posibilita la falsificación de la cadena de certificados.\n\nEn lib/public_key/src/pubkey_cert.erl, pubkey_cert:validate_extensions/7 contiene dos fallos que juntos permiten que un certificado con basicConstraints cA:false y sin extensión keyUsage sea utilizado como emisor intermedio en una cadena pasada a public_key:pkix_path_validation/3: la cláusula cA:false recurre en las extensiones restantes sin rechazar el certificado cuando está en posición de emisor, y la verificación de keyUsage solo se activa cuando la extensión está presente, por lo que un certificado que carece de keyUsage elude completamente la aplicación de keyCertSign.\n\nCualquier parte que posea un certificado de entidad final con basicConstraints cA:false y sin extensión keyUsage, emitido por cualquier CA en el almacén de confianza de la víctima, puede usar la clave privada de ese certificado para firmar certificados hoja falsificados para identidades arbitrarias. public_key:pkix_path_validation/3 acepta la cadena resultante, y por extensión, cada endpoint TLS o mTLS construido sobre la aplicación OTP ssl que depende del verificador predeterminado se ve afectado, incluyendo la verificación de identidad del servidor en el lado del cliente y la verificación de certificados del cliente en servidores mTLS.\n\nEste problema afecta a OTP desde la versión OTP 17.0 hasta versiones anteriores a la OTP 27.3.4.19, así como a las versiones OTP 28.5.0.8 y OTP 29.1.2, lo que corresponde a public_key desde la versión 0.22 hasta versiones anteriores a la 1.17.1.7, así como a las versiones 1.20.3.6 y 1.21.8. Se desconoce si OTP en versiones anteriores a la OTP 17.0, lo que corresponde a public_key en versiones anteriores a la 0.22, se ve afectado."
    }
  ],
  "affected": [
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "affectedData": [
        {
          "vendor": "Erlang",
          "product": "OTP",
          "defaultStatus": "unknown",
          "packageName": "otp",
          "cpes": [
            "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "pubkey_cert"
          ],
          "programFiles": [
            "lib/public_key/src/pubkey_cert.erl"
          ],
          "programRoutines": [
            {
              "name": "pubkey_cert:validate_extensions/7"
            }
          ],
          "packageURL": "pkg:software-id/erlang.org/otp",
          "versions": [
            {
              "version": "17.0",
              "lessThan": "*",
              "versionType": "otp",
              "status": "affected",
              "changes": [
                {
                  "at": "27.3.4.19",
                  "status": "unaffected"
                },
                {
                  "at": "28.5.0.8",
                  "status": "unaffected"
                },
                {
                  "at": "29.1.2",
                  "status": "unaffected"
                }
              ]
            }
          ]
        },
        {
          "vendor": "Erlang",
          "product": "OTP",
          "defaultStatus": "unknown",
          "packageName": "public_key",
          "cpes": [
            "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "pubkey_cert"
          ],
          "programFiles": [
            "src/pubkey_cert.erl"
          ],
          "programRoutines": [
            {
              "name": "pubkey_cert:validate_extensions/7"
            }
          ],
          "repo": "https://github.com/erlang/otp",
          "packageURL": "pkg:otp/public_key?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Ferlang%2Fotp.git",
          "versions": [
            {
              "version": "0.22",
              "lessThan": "*",
              "versionType": "otp",
              "status": "affected",
              "changes": [
                {
                  "at": "1.17.1.7",
                  "status": "unaffected"
                },
                {
                  "at": "1.20.3.6",
                  "status": "unaffected"
                },
                {
                  "at": "1.21.8",
                  "status": "unaffected"
                }
              ]
            }
          ]
        },
        {
          "vendor": "Erlang",
          "product": "OTP",
          "defaultStatus": "unknown",
          "collectionURL": "https://github.com",
          "packageName": "erlang/otp",
          "cpes": [
            "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "pubkey_cert"
          ],
          "programFiles": [
            "lib/public_key/src/pubkey_cert.erl"
          ],
          "programRoutines": [
            {
              "name": "pubkey_cert:validate_extensions/7"
            }
          ],
          "repo": "https://github.com/erlang/otp",
          "packageURL": "pkg:github/erlang/otp",
          "versions": [
            {
              "version": "84adefa331c4159d432d22840663c38f155cd4c1",
              "lessThan": "*",
              "versionType": "git",
              "status": "affected",
              "changes": [
                {
                  "at": "0a05b7ca33fb0b3f0a6cb9ae34252bb3a74032b8",
                  "status": "unaffected"
                },
                {
                  "at": "75ca4c0dc2bbdb286ac3c3fe89cb4b4d2b4dc333",
                  "status": "unaffected"
                },
                {
                  "at": "82af606b5437c4de1276dbcc8855a47e88231226",
                  "status": "unaffected"
                }
              ]
            },
            {
              "version": "0a05b7ca33fb0b3f0a6cb9ae34252bb3a74032b8",
              "lessThan": "*",
              "versionType": "git",
              "status": "unaffected"
            },
            {
              "version": "75ca4c0dc2bbdb286ac3c3fe89cb4b4d2b4dc333",
              "lessThan": "*",
              "versionType": "git",
              "status": "unaffected"
            },
            {
              "version": "82af606b5437c4de1276dbcc8855a47e88231226",
              "lessThan": "*",
              "versionType": "git",
              "status": "unaffected"
            }
          ]
        }
      ]
    },
    {
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "affectedData": [
        {
          "vendor": "Red Hat",
          "product": "Red Hat OpenStack Platform 16.2",
          "defaultStatus": "affected",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "erlang",
          "cpes": [
            "cpe:/a:redhat:openstack:16.2::el8"
          ],
          "versions": [
            {
              "version": "0:23.3.4.18-2.el8ost",
              "lessThan": "*",
              "versionType": "rpm",
              "status": "unaffected"
            }
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat OpenStack Services on OpenShift 18.0",
          "defaultStatus": "affected",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "erlang",
          "cpes": [
            "cpe:/a:redhat:openstack:18.0::el9"
          ],
          "versions": [
            {
              "version": "0:26.2.5.21-2.el9ost",
              "lessThan": "*",
              "versionType": "rpm",
              "status": "unaffected"
            }
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat Hardened Images",
          "defaultStatus": "affected",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "erlang27",
          "cpes": [
            "cpe:/a:redhat:hummingbird:1"
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat OpenStack Platform 17.1",
          "defaultStatus": "affected",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "erlang",
          "cpes": [
            "cpe:/a:redhat:openstack:17.1"
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 7.0,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "LOW",
          "vulnIntegrityImpact": "LOW",
          "vulnAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "HIGH",
          "subIntegrityImpact": "HIGH",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
          "baseScore": 4.8,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 2.5
      },
      {
        "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N",
          "baseScore": 8.0,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 5.8
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-27T15:41:47.903975Z",
          "id": "CVE-2026-42789",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-295"
        },
        {
          "lang": "en",
          "value": "CWE-296"
        }
      ]
    },
    {
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-295"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "17.0",
              "versionEndExcluding": "26.2.5.21",
              "matchCriteriaId": "F25CA266-A367-4D08-8717-0D1A6694DBDC"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "27.0",
              "versionEndExcluding": "27.3.4.12",
              "matchCriteriaId": "91269F6D-B8A3-41F2-871C-79EBB9460BE8"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "28.0",
              "versionEndExcluding": "28.5.0.1",
              "matchCriteriaId": "844A3F01-AF3C-4C48-81DB-932B803D22C4"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "29.0",
              "versionEndExcluding": "29.0.1",
              "matchCriteriaId": "46976598-817C-4E93-AC4B-46434746C25F"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://cna.erlef.org/cves/CVE-2026-42789.html",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "tags": [
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://github.com/erlang/otp/commit/0a05b7ca33fb0b3f0a6cb9ae34252bb3a74032b8",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    },
    {
      "url": "https://github.com/erlang/otp/commit/75ca4c0dc2bbdb286ac3c3fe89cb4b4d2b4dc333",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    },
    {
      "url": "https://github.com/erlang/otp/commit/82af606b5437c4de1276dbcc8855a47e88231226",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    },
    {
      "url": "https://github.com/erlang/otp/security/advisories/GHSA-c99q-jmpx-v8qq",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "tags": [
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://osv.dev/vulnerability/EEF-CVE-2026-42789",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "tags": [
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://www.erlang.org/doc/system/versions.html#order-of-versions",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "tags": [
        "Product"
      ]
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:39809",
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:54757",
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    },
    {
      "url": "https://access.redhat.com/security/cve/CVE-2026-42789",
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482093",
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    },
    {
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42789.json",
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    }
  ]
}