{"uuid": "8df693d3-38e3-4ee0-b4a5-e8d95d54dac9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "title": "Researcher clarification and primary references for CVE-2026-14440", "description": "I am the finder and reporter credited in the CVE record for CVE-2026-14440.\n\nThis vulnerability concerns Cloudflare Universal SSL\u2019s automatic management of the effective CAA RRset. On affected Universal SSL zones, the CAA RRset served by Cloudflare authoritative DNS can supersede customer-configured CAA records. Consequently, RFC 8657 `accounturi` and `validationmethods` constraints may not be visible to the Certificate Authority and are not preserved end-to-end.\n\nSuccessful exploitation is non-trivial and requires a capable network-level attacker that can satisfy the Certificate Authority\u2019s active domain-validation and Multi-Perspective Issuance Corroboration requirements. There is no public evidence confirming exploitation in the wild against Cloudflare Universal SSL customers.\n\nCustomers requiring strict RFC 8657 enforcement should ensure that another valid Cloudflare edge certificate is active before disabling Universal SSL. Certificate Transparency monitoring is useful for detection of misissuance, but it does not prevent certificate issuance and is not a substitute for preventive RFC 8657 enforcement.\n\nPrimary and persistent references:\n\n- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-14440\n- CISA CSAF advisory: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-183-01.json\n- Researcher analysis: https://david-osipov.vision/en/blog/cybersecurity/cloudflare-ssl-mitm-flaw-2026/\n- Archived research release: https://doi.org/10.5281/zenodo.21182737\n- Vulnerability Wikidata item: https://www.wikidata.org/wiki/Q140402353\n- Universal SSL Wikidata item: https://www.wikidata.org/wiki/Q140459847\n- Researcher identity: https://david-osipov.vision/en/about/#person", "description_format": "markdown", "vulnerability": "CVE-2026-14440", "creation_timestamp": "2026-07-17T20:29:56.262700+00:00", "timestamp": "2026-07-20T19:00:58.981609+00:00", "related_vulnerabilities": ["CVE-2026-14440"], "meta": [], "author": {"login": "David_Osipov", "name": "David Osipov", "uuid": "fe20f401-59e4-4c24-8cc4-fd4d68ea534d"}}