Common Weakness Enumeration
CWE-295
AllowedImproper Certificate Validation
Abstraction: Base · Status: Draft
The product does not validate, or incorrectly validates, a certificate.
2138 vulnerabilities reference this CWE, most recent first.
GCVE-1-2026-20085 (CVE-2026-85221)
Vulnerability from gna-1 – Published: 2026-09-03 14:16 – Updated: 2026-09-03 14:16
VLAI
EPSS
VEX
Title
MISP CurlClient TLS Peer Verification Disabled by Default Enables Man-in-the-Middle Attacks
Summary
MISP contains an improper TLS certificate validation vulnerability in CurlClient. The CurlClient::$verifyPeer property was not explicitly initialized and therefore defaulted to null. When passed to cURL, this value effectively disabled TLS peer verification unless the calling code explicitly enabled it.
As a result, HTTPS connections made through affected CurlClient instances could accept certificates that were not issued by a trusted certificate authority. An attacker capable of intercepting or manipulating network traffic between a MISP instance and a remote HTTPS service could impersonate the remote endpoint and perform a man-in-the-middle attack.
Successful exploitation could allow an attacker to observe sensitive information transmitted by MISP, including authentication material or exchanged threat intelligence, and to modify responses returned to the MISP instance. The impact depends on the functionality using CurlClient and the data exchanged with the remote service.
The patch enables TLS peer verification by default while preserving explicit support for configured self-signed certificates. It also corrects the self-signed certificate handling in SyncTool so that peer verification is disabled only when no pinned CA certificate is configured.
Severity
CWE
- CWE-295 - Improper Certificate Validation
Assigner
GNA-1
This instance
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/MISP/MISP/commit/e06f69858 | patch |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "misp",
"repo": "https://github.com/MISP/MISP",
"vendor": "misp",
"versions": [
{
"lessThanOrEqual": "2.5.45",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "remediation developer",
"value": "Andras Iklody"
},
{
"lang": "en",
"type": "tool",
"value": "Claude Opus 5 (1M context)"
},
{
"lang": "en",
"type": "finder",
"value": "elhoim (David Andr\u00e9)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eMISP contains an improper TLS certificate validation vulnerability in \u003ccode\u003eCurlClient\u003c/code\u003e. The \u003ccode\u003eCurlClient::$verifyPeer\u003c/code\u003e property was not explicitly initialized and therefore defaulted to \u003ccode\u003enull\u003c/code\u003e. When passed to cURL, this value effectively disabled TLS peer verification unless the calling code explicitly enabled it.\u003c/p\u003e\n\u003cp\u003eAs a result, HTTPS connections made through affected \u003ccode\u003eCurlClient\u003c/code\u003e instances could accept certificates that were not issued by a trusted certificate authority. An attacker capable of intercepting or manipulating network traffic between a MISP instance and a remote HTTPS service could impersonate the remote endpoint and perform a man-in-the-middle attack.\u003c/p\u003e\n\u003cp\u003eSuccessful exploitation could allow an attacker to observe sensitive information transmitted by MISP, including authentication material or exchanged threat intelligence, and to modify responses returned to the MISP instance. The impact depends on the functionality using \u003ccode\u003eCurlClient\u003c/code\u003e and the data exchanged with the remote service.\u003c/p\u003e\n\u003cp\u003eThe patch enables TLS peer verification by default while preserving explicit support for configured self-signed certificates. It also corrects the self-signed certificate handling in \u003ccode\u003eSyncTool\u003c/code\u003e so that peer verification is disabled only when no pinned CA certificate is configured.\u003c/p\u003e\u003cbr\u003e"
}
],
"value": "MISP contains an improper TLS certificate validation vulnerability in CurlClient. The CurlClient::$verifyPeer property was not explicitly initialized and therefore defaulted to null. When passed to cURL, this value effectively disabled TLS peer verification unless the calling code explicitly enabled it.\n\n\nAs a result, HTTPS connections made through affected CurlClient instances could accept certificates that were not issued by a trusted certificate authority. An attacker capable of intercepting or manipulating network traffic between a MISP instance and a remote HTTPS service could impersonate the remote endpoint and perform a man-in-the-middle attack.\n\n\nSuccessful exploitation could allow an attacker to observe sensitive information transmitted by MISP, including authentication material or exchanged threat intelligence, and to modify responses returned to the MISP instance. The impact depends on the functionality using CurlClient and the data exchanged with the remote service.\n\n\nThe patch enables TLS peer verification by default while preserving explicit support for configured self-signed certificates. It also corrects the self-signed certificate handling in SyncTool so that peer verification is disabled only when no pinned CA certificate is configured."
}
],
"impacts": [
{
"capecId": "CAPEC-94",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-94 Adversary in the Middle (AiTM)"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-295",
"description": "CWE-295 Improper Certificate Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"orgId": "00000000-0000-4000-9000-000000000000"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/MISP/MISP/commit/e06f69858"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "MISP CurlClient TLS Peer Verification Disabled by Default Enables Man-in-the-Middle Attacks",
"x_gcve": [
{
"recordType": "advisory",
"vulnId": "gcve-1-2026-20085"
}
],
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "00000000-0000-4000-9000-000000000000",
"cveId": "CVE-2026-85221",
"datePublished": "2026-09-03T14:16:48.294316Z",
"dateReserved": "2026-09-03T14:16:56.730Z",
"dateUpdated": "2026-09-03T14:16:56.806725Z",
"requesterUserId": "00000000-0000-4000-9000-000000000000",
"serial": 1,
"state": "PUBLISHED",
"vulnId": "gcve-1-2026-20085"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2026-20042 (GCVE-0-2026-20042)
Vulnerability from cvelistv5 – Published: 2026-04-01 16:27 – Updated: 2026-04-02 03:56
VLAI
EPSS
VEX
Title
Cisco Nexus Dashboard Configuration REST API Unauthorized Access Vulnerability
Summary
A vulnerability in the configuration backup feature of Cisco Nexus Dashboard could allow an attacker who has the encryption password and access to Full or Config-only backup files to access sensitive information.
This vulnerability exists because authentication details are included in the encrypted backup files. An attacker with a valid backup file and encryption password from an affected device could decrypt the backup file. The attacker could then use the authentication details in the backup file to access internal-only APIs on the affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system as the root user.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-04-01 00:00 UTC
CWE
- CWE-295 - Improper Certificate Validation
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Cisco | Cisco Nexus Dashboard |
Affected:
1.1(3e)
Affected: 1.1(3c) Affected: 1.1(3d) Affected: 1.1(0d) Affected: 1.1(2i) Affected: 2.0(1b) Affected: 1.1(2h) Affected: 1.1(0c) Affected: 1.1(3f) Affected: 2.1(1d) Affected: 2.1(1e) Affected: 2.0(2g) Affected: 2.0(2h) Affected: 2.1(2d) Affected: 2.0(1d) Affected: 2.2(1h) Affected: 2.2(1e) Affected: 2.2(2d) Affected: 2.1(2f) Affected: 2.3(1c) Affected: 2.3(2b) Affected: 2.3(2c) Affected: 2.3(2d) Affected: 2.3(2e) Affected: 3.0(1f) Affected: 3.0(1i) Affected: 3.1(1k) Affected: 3.1(1l) Affected: 3.2(1e) Affected: 3.2(1i) Affected: 3.3(1a) Affected: 3.3(1b) Affected: 3.3(2b) Affected: 4.0(1i) Affected: 3.3(2g) Affected: 3.2(2f) Affected: 3.2(2g) Affected: 3.2(2m) Affected: 3.1(1n) Affected: 4.1(1g) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-20042",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-01T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-02T03:56:08.575Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Cisco Nexus Dashboard",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "1.1(3e)"
},
{
"status": "affected",
"version": "1.1(3c)"
},
{
"status": "affected",
"version": "1.1(3d)"
},
{
"status": "affected",
"version": "1.1(0d)"
},
{
"status": "affected",
"version": "1.1(2i)"
},
{
"status": "affected",
"version": "2.0(1b)"
},
{
"status": "affected",
"version": "1.1(2h)"
},
{
"status": "affected",
"version": "1.1(0c)"
},
{
"status": "affected",
"version": "1.1(3f)"
},
{
"status": "affected",
"version": "2.1(1d)"
},
{
"status": "affected",
"version": "2.1(1e)"
},
{
"status": "affected",
"version": "2.0(2g)"
},
{
"status": "affected",
"version": "2.0(2h)"
},
{
"status": "affected",
"version": "2.1(2d)"
},
{
"status": "affected",
"version": "2.0(1d)"
},
{
"status": "affected",
"version": "2.2(1h)"
},
{
"status": "affected",
"version": "2.2(1e)"
},
{
"status": "affected",
"version": "2.2(2d)"
},
{
"status": "affected",
"version": "2.1(2f)"
},
{
"status": "affected",
"version": "2.3(1c)"
},
{
"status": "affected",
"version": "2.3(2b)"
},
{
"status": "affected",
"version": "2.3(2c)"
},
{
"status": "affected",
"version": "2.3(2d)"
},
{
"status": "affected",
"version": "2.3(2e)"
},
{
"status": "affected",
"version": "3.0(1f)"
},
{
"status": "affected",
"version": "3.0(1i)"
},
{
"status": "affected",
"version": "3.1(1k)"
},
{
"status": "affected",
"version": "3.1(1l)"
},
{
"status": "affected",
"version": "3.2(1e)"
},
{
"status": "affected",
"version": "3.2(1i)"
},
{
"status": "affected",
"version": "3.3(1a)"
},
{
"status": "affected",
"version": "3.3(1b)"
},
{
"status": "affected",
"version": "3.3(2b)"
},
{
"status": "affected",
"version": "4.0(1i)"
},
{
"status": "affected",
"version": "3.3(2g)"
},
{
"status": "affected",
"version": "3.2(2f)"
},
{
"status": "affected",
"version": "3.2(2g)"
},
{
"status": "affected",
"version": "3.2(2m)"
},
{
"status": "affected",
"version": "3.1(1n)"
},
{
"status": "affected",
"version": "4.1(1g)"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the configuration backup feature of Cisco Nexus Dashboard could allow an attacker who has the encryption password and access to Full or Config-only backup files to access sensitive information.\r\n\r\nThis vulnerability exists because authentication details are included in the encrypted backup files. An attacker with a valid backup file and encryption password from an affected device could decrypt the backup file. The attacker could then use the authentication details in the backup file to access internal-only APIs on the affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system as the root user."
}
],
"exploits": [
{
"lang": "en",
"value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "cvssV3_1"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-295",
"description": "Improper Certificate Validation",
"lang": "en",
"type": "cwe"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-01T16:27:49.948Z",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "cisco-sa-nd-cbid-5YqkOSHu",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nd-cbid-5YqkOSHu"
}
],
"source": {
"advisory": "cisco-sa-nd-cbid-5YqkOSHu",
"defects": [
"CSCwq66302"
],
"discovery": "INTERNAL"
},
"title": "Cisco Nexus Dashboard Configuration REST API Unauthorized Access Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2026-20042",
"datePublished": "2026-04-01T16:27:49.948Z",
"dateReserved": "2025-10-08T11:59:15.354Z",
"dateUpdated": "2026-04-02T03:56:08.575Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-18717 (GCVE-0-2026-18717)
Vulnerability from cvelistv5 – Published: 2026-08-27 20:20 – Updated: 2026-08-28 15:58
VLAI
EPSS
VEX
Title
Improper Certificate Validation in ASE 2000
Summary
ASE2000 2.35 through 2.37 is vulnerable to an improper certificate validation vulnerability, which may allow an attacker to impersonate the trusted peer, complete the TLS handshake, and read or modify protected communications.
Severity
7.4 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-28 15:45 UTC
CWE
- CWE-295 - Improper certificate validation
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Applied Systems Engineering | ASE2000 V2 |
Affected:
2.25 , ≤ 2.37
(custom)
Unaffected: 2.38 |
Date Public
2026-08-27 18:30
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-18717",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-28T15:45:48.703173Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T15:58:08.375Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "ASE2000 V2",
"vendor": "Applied Systems Engineering",
"versions": [
{
"lessThanOrEqual": "2.37",
"status": "affected",
"version": "2.25",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "2.38"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Enoch Wang reported this vulnerability to CISA."
}
],
"datePublic": "2026-08-27T18:30:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "ASE2000 2.35 through 2.37 is vulnerable to an improper certificate validation vulnerability, which may allow an attacker to impersonate the trusted peer, complete the TLS handshake, and read or modify protected communications."
}
],
"value": "ASE2000 2.35 through 2.37 is vulnerable to an improper certificate validation vulnerability, which may allow an attacker to impersonate the trusted peer, complete the TLS handshake, and read or modify protected communications."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-295",
"description": "CWE-295 Improper certificate validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T20:20:23.451Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "http://www.ase-systems.com"
},
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-239-04"
},
{
"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-239-04.json"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "ASE/Kalkitech provides an upgraded version 2.38 that fixes both vulnerabilities and customers are advised to upgrade to version 2.38. In version 2.38 the bundled log4net library is upgraded to version 3.3.1.0, and the IEC 60870-5-104 TLS client certificate validation logic is corrected to ensure proper validation of certificate error conditions.\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003eAll customers running ASE2000 versions 2.25 through 2.37 are affected by this issue and are required to upgrade to version 2.38 or later to apply the security fix. Upgrade instructions and user documentation are available at \u003ca href=\"www.ase-systems.com\"\u003ewww.ase-systems.com\u003c/a\u003e. For detailed, step-by-step guidance on upgrading to the latest version and patching the impacted components, please contact our support team at support@ase-systems.com.\u003c/div\u003e"
}
],
"value": "ASE/Kalkitech provides an upgraded version 2.38 that fixes both vulnerabilities and customers are advised to upgrade to version 2.38. In version 2.38 the bundled log4net library is upgraded to version 3.3.1.0, and the IEC 60870-5-104 TLS client certificate validation logic is corrected to ensure proper validation of certificate error conditions.\n\n\nAll customers running ASE2000 versions 2.25 through 2.37 are affected by this issue and are required to upgrade to version 2.38 or later to apply the security fix. Upgrade instructions and user documentation are available at www.ase-systems.com . For detailed, step-by-step guidance on upgrading to the latest version and patching the impacted components, please contact our support team at support@ase-systems.com."
}
],
"source": {
"advisory": "ICSA-26-239-04",
"discovery": "UNKNOWN"
},
"title": "Improper Certificate Validation in ASE 2000",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003eUntil the upgrade can be applied, the following interim measures reduce exposure:\u003c/div\u003e\u003cul\u003e\u003cli\u003eRestrict write access to the ASE2000 installation directory and its configuration files to trusted administrators only.\u003c/li\u003e\u003cli\u003eAvoid\n using IEC 60870-5-104 over TLS across untrusted or shared networks; \nplace ASE2000 hosts on an isolated, segmented network reachable only by \nintended peers.\u003c/li\u003e\u003cli\u003eEnsure the host is protected by a network firewall.\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "Until the upgrade can be applied, the following interim measures reduce exposure:\n\n * Restrict write access to the ASE2000 installation directory and its configuration files to trusted administrators only.\n * Avoid\n using IEC 60870-5-104 over TLS across untrusted or shared networks; \nplace ASE2000 hosts on an isolated, segmented network reachable only by \nintended peers.\n * Ensure the host is protected by a network firewall."
}
],
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2026-18717",
"datePublished": "2026-08-27T20:20:23.451Z",
"dateReserved": "2026-08-03T16:30:40.486Z",
"dateUpdated": "2026-08-28T15:58:08.375Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-18679 (GCVE-0-2026-18679)
Vulnerability from cvelistv5 – Published: 2026-08-12 18:52 – Updated: 2026-08-13 14:45
VLAI
EPSS
VEX
Title
Kong Mesh: kuma-dp connects to the control plane without verifying the TLS certificate when no CA is configured
Summary
When kuma-dp is started against an HTTPS control plane and the operator did not pass a CA certificate, the data plane connects with TLS peer verification disabled, and the dataplane authentication token is sent over that unverified connection.
An on-path actor can intercept the dataplane authentication token and impersonate the control plane to the data plane, injecting a forged bootstrap configuration and taking over the proxy.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-13 14:45 UTC
CWE
- CWE-295 - Improper Certificate Validation
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/kumahq/kuma/security/advisorie… | vendor-advisory |
| https://github.com/kumahq/kuma/pull/16777 | patch |
| https://developer.konghq.com/mesh/changelog/ | release-notes |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-18679",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-13T14:45:22.142897Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T14:45:35.957Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"kuma-dp"
],
"platforms": [
"Linux"
],
"product": "Kong Mesh",
"vendor": "Kong Inc.",
"versions": [
{
"lessThan": "2.7.26",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "2.9.16",
"status": "affected",
"version": "2.8.0",
"versionType": "semver"
},
{
"lessThan": "2.11.14",
"status": "affected",
"version": "2.10.0",
"versionType": "semver"
},
{
"lessThan": "2.12.11",
"status": "affected",
"version": "2.12.0",
"versionType": "semver"
},
{
"lessThan": "2.13.7",
"status": "affected",
"version": "2.13.0",
"versionType": "semver"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eYou are affected if you run universal mode \u003ccode\u003ekuma-dp\u003c/code\u003e against an HTTPS control plane without \u003ccode\u003e--ca-cert-file\u003c/code\u003e, or with \u003ccode\u003eKUMA_CONTROL_PLANE_CA_CERT\u003c/code\u003e unset.\u003c/p\u003e\u003cp\u003eYou are not affected if you install on Kubernetes through \u003ccode\u003ekumactl install control-plane\u003c/code\u003e or the official Kong Mesh Helm chart. In both cases the control plane\u0027s mutating admission webhook injects \u003ccode\u003eKUMA_CONTROL_PLANE_CA_CERT\u003c/code\u003e into every sidecar at pod admission, so each \u003ccode\u003ekuma-dp\u003c/code\u003e starts with the CA already configured.\u003c/p\u003e"
}
],
"value": "You are affected if you run universal mode kuma-dp against an HTTPS control plane without --ca-cert-file, or with KUMA_CONTROL_PLANE_CA_CERT unset.\n\n\n\nYou are not affected if you install on Kubernetes through kumactl install control-plane or the official Kong Mesh Helm chart. In both cases the control plane\u0027s mutating admission webhook injects KUMA_CONTROL_PLANE_CA_CERT into every sidecar at pod admission, so each kuma-dp starts with the CA already configured."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eWhen \u003ccode\u003ekuma-dp\u003c/code\u003e is started against an HTTPS control plane and the operator did not pass a CA certificate, the data plane connects with TLS peer verification disabled, and the dataplane authentication token is sent over that unverified connection.\u003c/p\u003e\u003cp\u003eAn on-path actor can intercept the dataplane authentication token and impersonate the control plane to the data plane, injecting a forged bootstrap configuration and taking over the proxy.\u003c/p\u003e"
}
],
"value": "When kuma-dp is started against an HTTPS control plane and the operator did not pass a CA certificate, the data plane connects with TLS peer verification disabled, and the dataplane authentication token is sent over that unverified connection.\n\n\n\nAn on-path actor can intercept the dataplane authentication token and impersonate the control plane to the data plane, injecting a forged bootstrap configuration and taking over the proxy."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "Control plane impersonation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "ADJACENT",
"baseScore": 5.8,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-295",
"description": "CWE-295 Improper Certificate Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T18:52:31.146Z",
"orgId": "02762ae7-200e-4b20-9b2b-a77d5b8fc4cb",
"shortName": "Kong"
},
"references": [
{
"name": "Upstream advisory GHSA-wvmp-6r4v-j6cv",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/kumahq/kuma/security/advisories/GHSA-wvmp-6r4v-j6cv"
},
{
"name": "kumahq/kuma#16777 (master)",
"tags": [
"patch"
],
"url": "https://github.com/kumahq/kuma/pull/16777"
},
{
"name": "Kong MESH Changelog",
"tags": [
"release-notes"
],
"url": "https://developer.konghq.com/mesh/changelog/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUpgrade to Kong Mesh 2.7.26, 2.9.16, 2.11.14, 2.12.11 or 2.13.7, whichever matches your release line. Patched releases fall back to the operating system trust store instead of disabling verification, so a publicly trusted control plane certificate verifies with no further configuration. The 2.14 line shipped after the fix and was never affected.\u003c/p\u003e"
}
],
"value": "Upgrade to Kong Mesh 2.7.26, 2.9.16, 2.11.14, 2.12.11 or 2.13.7, whichever matches your release line. Patched releases fall back to the operating system trust store instead of disabling verification, so a publicly trusted control plane certificate verifies with no further configuration. The 2.14 line shipped after the fix and was never affected."
}
],
"source": {
"discovery": "INTERNAL"
},
"timeline": [
{
"lang": "en",
"time": "2026-06-03T20:20:00.000Z",
"value": "Kong Mesh patched releases published"
},
{
"lang": "en",
"time": "2026-07-16T16:42:00.000Z",
"value": "Upstream advisory GHSA-wvmp-6r4v-j6cv published"
}
],
"title": "Kong Mesh: kuma-dp connects to the control plane without verifying the TLS certificate when no CA is configured",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eSet \u003ccode\u003e--ca-cert-file\u003c/code\u003e, or \u003ccode\u003eKUMA_CONTROL_PLANE_CA_CERT\u003c/code\u003e, on every universal mode data plane and point it at the control plane\u0027s serving CA. Alternatively terminate the control plane behind a publicly trusted certificate.\u003c/p\u003e"
}
],
"value": "Set --ca-cert-file, or KUMA_CONTROL_PLANE_CA_CERT, on every universal mode data plane and point it at the control plane\u0027s serving CA. Alternatively terminate the control plane behind a publicly trusted certificate."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "02762ae7-200e-4b20-9b2b-a77d5b8fc4cb",
"assignerShortName": "Kong",
"cveId": "CVE-2026-18679",
"datePublished": "2026-08-12T18:52:31.146Z",
"dateReserved": "2026-08-03T15:20:48.055Z",
"dateUpdated": "2026-08-13T14:45:35.957Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-18678 (GCVE-0-2026-18678)
Vulnerability from cvelistv5 – Published: 2026-08-12 18:49 – Updated: 2026-08-13 14:47
VLAI
EPSS
VEX
Title
Kong Mesh: kumactl connects to the control plane without verifying the TLS certificate when no CA is configured
Summary
When an operator adds an HTTPS control plane profile to kumactl without providing a CA certificate, kumactl disables TLS verification and sends API tokens over the unverified connection.
An attacker on the network path between the operator and the control plane can intercept user or admin API tokens and then act against the control plane as that user.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-13 14:47 UTC
CWE
- CWE-295 - Improper Certificate Validation
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/kumahq/kuma/security/advisorie… | vendor-advisory |
| https://github.com/kumahq/kuma/pull/16777 | patch |
| https://developer.konghq.com/mesh/changelog/ | release-notes |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-18678",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-13T14:47:28.559922Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T14:47:36.551Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"kumactl"
],
"platforms": [
"Linux"
],
"product": "Kong Mesh",
"vendor": "Kong Inc.",
"versions": [
{
"lessThan": "2.7.26",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "2.9.16",
"status": "affected",
"version": "2.8.0",
"versionType": "semver"
},
{
"lessThan": "2.11.14",
"status": "affected",
"version": "2.10.0",
"versionType": "semver"
},
{
"lessThan": "2.12.11",
"status": "affected",
"version": "2.12.0",
"versionType": "semver"
},
{
"lessThan": "2.13.7",
"status": "affected",
"version": "2.13.0",
"versionType": "semver"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eYou are affected if you have \u003ccode\u003ekumactl\u003c/code\u003e profiles manually added against an HTTPS control plane endpoint without \u003ccode\u003e--ca-cert-file\u003c/code\u003e.\u003c/p\u003e\u003cp\u003eYou are not affected if you use the default local profile, which uses plain HTTP.\u003c/p\u003e"
}
],
"value": "You are affected if you have kumactl profiles manually added against an HTTPS control plane endpoint without --ca-cert-file.\n\n\n\nYou are not affected if you use the default local profile, which uses plain HTTP."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eWhen an operator adds an HTTPS control plane profile to \u003ccode\u003ekumactl\u003c/code\u003e without providing a CA certificate, \u003ccode\u003ekumactl\u003c/code\u003e disables TLS verification and sends API tokens over the unverified connection.\u003c/p\u003e\u003cp\u003eAn attacker on the network path between the operator and the control plane can intercept user or admin API tokens and then act against the control plane as that user.\u003c/p\u003e"
}
],
"value": "When an operator adds an HTTPS control plane profile to kumactl without providing a CA certificate, kumactl disables TLS verification and sends API tokens over the unverified connection.\n\n\n\nAn attacker on the network path between the operator and the control plane can intercept user or admin API tokens and then act against the control plane as that user."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "Credential interception"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "ADJACENT",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-295",
"description": "CWE-295 Improper Certificate Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T18:49:45.530Z",
"orgId": "02762ae7-200e-4b20-9b2b-a77d5b8fc4cb",
"shortName": "Kong"
},
"references": [
{
"name": "Upstream advisory GHSA-v95x-xhq5-4929",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/kumahq/kuma/security/advisories/GHSA-v95x-xhq5-4929"
},
{
"name": "kumahq/kuma#16777 (master)",
"tags": [
"patch"
],
"url": "https://github.com/kumahq/kuma/pull/16777"
},
{
"name": "Kong MESH Changelog",
"tags": [
"release-notes"
],
"url": "https://developer.konghq.com/mesh/changelog/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUpgrade to Kong Mesh 2.7.26, 2.9.16, 2.11.14, 2.12.11 or 2.13.7, whichever matches your release line. Patched releases fall back to the operating system trust store instead of disabling verification, so a publicly trusted control plane certificate verifies with no further configuration. The 2.14 line shipped after the fix and was never affected.\u003c/p\u003e"
}
],
"value": "Upgrade to Kong Mesh 2.7.26, 2.9.16, 2.11.14, 2.12.11 or 2.13.7, whichever matches your release line. Patched releases fall back to the operating system trust store instead of disabling verification, so a publicly trusted control plane certificate verifies with no further configuration. The 2.14 line shipped after the fix and was never affected."
}
],
"source": {
"discovery": "INTERNAL"
},
"timeline": [
{
"lang": "en",
"time": "2026-06-03T20:20:00.000Z",
"value": "Kong Mesh patched releases published"
},
{
"lang": "en",
"time": "2026-07-16T16:42:00.000Z",
"value": "Upstream advisory GHSA-v95x-xhq5-4929 published"
}
],
"title": "Kong Mesh: kumactl connects to the control plane without verifying the TLS certificate when no CA is configured",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eWhen adding an HTTPS control plane profile to \u003ccode\u003ekumactl\u003c/code\u003e, always pass \u003ccode\u003e--ca-cert-file\u003c/code\u003e pointing at the control plane\u0027s serving CA. Alternatively terminate the control plane behind a publicly trusted certificate.\u003c/p\u003e"
}
],
"value": "When adding an HTTPS control plane profile to kumactl, always pass --ca-cert-file pointing at the control plane\u0027s serving CA. Alternatively terminate the control plane behind a publicly trusted certificate."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "02762ae7-200e-4b20-9b2b-a77d5b8fc4cb",
"assignerShortName": "Kong",
"cveId": "CVE-2026-18678",
"datePublished": "2026-08-12T18:49:45.530Z",
"dateReserved": "2026-08-03T15:20:46.760Z",
"dateUpdated": "2026-08-13T14:47:36.551Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-18257 (GCVE-0-2026-18257)
Vulnerability from cvelistv5 – Published: 2026-07-29 16:34 – Updated: 2026-07-29 18:04
VLAI
EPSS
VEX
Title
Improper Certificate Validation in S2OPC
Summary
Improper validity period check for root issuer certificate in CycloneCrypto cryptographic wrapper of S2OPC allows a certificate issued by this root issuer to be considered trusted
Severity
5.6 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-29 18:04 UTC
CWE
- CWE-295 - Improper Certificate Validation
Assigner
References
1 reference
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-18257",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-29T18:04:43.478121Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-29T18:04:53.132Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "S2OPC",
"vendor": "Systerel",
"versions": [
{
"lessThan": "2.0.0",
"status": "affected",
"version": "1.5.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Systerel"
}
],
"descriptions": [
{
"lang": "en",
"value": "Improper validity period check for root issuer certificate in CycloneCrypto cryptographic wrapper of S2OPC allows a certificate issued by this root issuer to be considered trusted"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-295",
"description": "CWE-295: Improper Certificate Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-29T16:34:09.688Z",
"orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
"shortName": "GitLab"
},
"references": [
{
"url": "https://gitlab.com/systerel/S2OPC/-/work_items/1804"
}
],
"solutions": [
{
"lang": "en",
"value": "Use mbedtls cryptographic wrapper of S2OPC. Or upgrade S2OPC to use CycloneCrypto wrapper of release version \u003e= 2.0.0 or master commit \u003e= 839ae878"
}
],
"title": "Improper Certificate Validation in S2OPC"
}
},
"cveMetadata": {
"assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
"assignerShortName": "GitLab",
"cveId": "CVE-2026-18257",
"datePublished": "2026-07-29T16:34:09.688Z",
"dateReserved": "2026-07-29T16:33:59.899Z",
"dateUpdated": "2026-07-29T18:04:53.132Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-18141 (GCVE-0-2026-18141)
Vulnerability from cvelistv5 – Published: 2026-07-31 15:34 – Updated: 2026-08-04 21:42
VLAI
EPSS
VEX
Title
Aap-gateway: aap-gateway: authentication bypass in event-driven ansible via forged http header
Summary
A flaw was found in aap-gateway, a component of Ansible Automation Platform's Event-Driven Ansible (EDA). An unauthenticated remote attacker can bypass mutual Transport Layer Security (mTLS) authentication for event streams. This is achieved by manipulating the event stream URL and forging the HTTP Subject header. The system also inadvertently discloses the expected certificate subject in error messages, which simplifies the attack. This vulnerability allows an attacker to inject arbitrary events into EDA, potentially triggering automated workflows.
Severity
8.2 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-31 18:58 UTC
CWE
- CWE-295 - Improper Certificate Validation
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://access.redhat.com/errata/RHSA-2026:50336 | vendor-advisoryx_refsource_REDHAT |
| https://access.redhat.com/errata/RHSA-2026:50340 | vendor-advisoryx_refsource_REDHAT |
| https://access.redhat.com/errata/RHSA-2026:50479 | vendor-advisoryx_refsource_REDHAT |
| https://access.redhat.com/security/cve/CVE-2026-18141 | vdb-entryx_refsource_REDHAT |
| https://bugzilla.redhat.com/show_bug.cgi?id=2508155 | issue-trackingx_refsource_REDHAT |
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| Red Hat | Red Hat Ansible Automation Platform 2.6 for RHEL 9 |
Unaffected:
0:1.2.11-1.el9ap , < *
(rpm)
cpe:/a:redhat:ansible_automation_platform:2.6::el10 cpe:/a:redhat:ansible_automation_platform:2.6::el9 cpe:/a:redhat:ansible_automation_platform_developer:2.6::el10 cpe:/a:redhat:ansible_automation_platform_developer:2.6::el9 cpe:/a:redhat:ansible_automation_platform_inside:2.6::el9 |
|
| Red Hat | Red Hat Ansible Automation Platform 2.6 |
Unaffected:
1785780020 , < *
(rpm)
cpe:/a:redhat:ansible_automation_platform:2.6::el9 |
|
| Red Hat | Red Hat Ansible Automation Platform 2.7 |
Unaffected:
1785435970 , < *
(rpm)
cpe:/a:redhat:ansible_automation_platform:2.7::el9 |
|
| Red Hat | Red Hat Ansible Automation Platform 2 |
cpe:/a:redhat:ansible_automation_platform:2
|
Date Public
2026-07-31 15:28
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-18141",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-31T18:58:11.455352Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T19:00:47.232Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2.6::el10",
"cpe:/a:redhat:ansible_automation_platform:2.6::el9",
"cpe:/a:redhat:ansible_automation_platform_developer:2.6::el10",
"cpe:/a:redhat:ansible_automation_platform_developer:2.6::el9",
"cpe:/a:redhat:ansible_automation_platform_inside:2.6::el9"
],
"defaultStatus": "affected",
"packageName": "automation-eda-controller",
"product": "Red Hat Ansible Automation Platform 2.6 for RHEL 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:1.2.11-1.el9ap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2.6::el9"
],
"defaultStatus": "affected",
"packageName": "ansible-automation-platform-26/gateway-rhel9",
"product": "Red Hat Ansible Automation Platform 2.6",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1785780020",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2.7::el9"
],
"defaultStatus": "affected",
"packageName": "ansible-automation-platform-27/gateway-rhel9",
"product": "Red Hat Ansible Automation Platform 2.7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1785435970",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
],
"defaultStatus": "unaffected",
"packageName": "ansible-automation-platform-25/gateway-rhel8",
"product": "Red Hat Ansible Automation Platform 2",
"vendor": "Red Hat"
}
],
"datePublic": "2026-07-31T15:28:47.213Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in aap-gateway, a component of Ansible Automation Platform\u0027s Event-Driven Ansible (EDA). An unauthenticated remote attacker can bypass mutual Transport Layer Security (mTLS) authentication for event streams. This is achieved by manipulating the event stream URL and forging the HTTP Subject header. The system also inadvertently discloses the expected certificate subject in error messages, which simplifies the attack. This vulnerability allows an attacker to inject arbitrary events into EDA, potentially triggering automated workflows."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-295",
"description": "Improper Certificate Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-04T21:42:24.939Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"name": "RHSA-2026:50336",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:50336"
},
{
"name": "RHSA-2026:50340",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:50340"
},
{
"name": "RHSA-2026:50479",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:50479"
},
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-18141"
},
{
"name": "RHBZ#2508155",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2508155"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-28T18:46:28.174Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-07-31T15:28:47.213Z",
"value": "Made public."
}
],
"title": "Aap-gateway: aap-gateway: authentication bypass in event-driven ansible via forged http header",
"workarounds": [
{
"lang": "en",
"value": "Restrict network access to the EDA event stream endpoints at the firewall or load balancer level. Ensure that only trusted sources are permitted to reach the event stream ports. Additionally, monitor EDA event logs for any unexpected events originating from unverified sources."
}
],
"x_generator": {
"engine": "cvelib 1.8.0"
},
"x_redhatCweChain": "CWE-295: Improper Certificate Validation"
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2026-18141",
"datePublished": "2026-07-31T15:34:16.724Z",
"dateReserved": "2026-07-28T18:47:42.043Z",
"dateUpdated": "2026-08-04T21:42:24.939Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-18129 (GCVE-0-2026-18129)
Vulnerability from cvelistv5 – Published: 2026-08-11 14:26 – Updated: 2026-08-12 04:00
VLAI
EPSS
VEX
Summary
Cleartext transmission of sensitive information in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remote unauthenticated attacker in a MITM position to leak credentials for external SQL connections.
Severity
8.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-11 00:00 UTC
CWE
- CWE-295 - Improper certificate validation
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Ivanti | Endpoint Manager |
Unaffected:
2024 SU7
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-18129",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-11T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T04:00:00.979Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "Endpoint Manager",
"vendor": "Ivanti",
"versions": [
{
"status": "unaffected",
"version": "2024 SU7",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Cleartext transmission of sensitive information in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remote unauthenticated attacker in a MITM position to leak credentials for external SQL connections.\u0026nbsp;"
}
],
"value": "Cleartext transmission of sensitive information in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remote unauthenticated attacker in a MITM position to leak credentials for external SQL connections."
}
],
"impacts": [
{
"capecId": "CAPEC-117",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-117 Interception"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-295",
"description": "CWE-295 Improper certificate validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-11T14:26:36.132Z",
"orgId": "3c1d8aa1-5a33-4ea4-8992-aadd6440af75",
"shortName": "ivanti"
},
"references": [
{
"url": "https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-EPM-August-2026"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "3c1d8aa1-5a33-4ea4-8992-aadd6440af75",
"assignerShortName": "ivanti",
"cveId": "CVE-2026-18129",
"datePublished": "2026-08-11T14:26:36.132Z",
"dateReserved": "2026-07-28T18:10:09.233Z",
"dateUpdated": "2026-08-12T04:00:00.979Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-18089 (GCVE-0-2026-18089)
Vulnerability from cvelistv5 – Published: 2026-08-03 12:42 – Updated: 2026-08-03 19:56
VLAI
EPSS
VEX
Title
Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass by verifying responses against the response-embedded certificate in verify_xml when no trust anchor is configured
Summary
Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass by verifying responses against the response-embedded certificate in verify_xml when no trust anchor is configured.
verify_xml in Net::SAML2::Role::VerifyXML runs "return if !$anchors && !$cacert;" as soon as the XML::Sig check succeeds, and that check uses the X.509 certificate taken from the response's own dsig:KeyInfo/dsig:X509Certificate element, so an unanchored response is checked only against the key it carries. Binding::POST declares cacert as an optional Maybe[Str] with no default, so a POST binding built without one takes that path, and _verify_encrypted_assertion returns early the same way with "return $xml unless $cacert;".
Any caller that constructs Binding::POST or calls Assertion->new_from_xml without a cacert, cert_text, or anchors argument accepts a response signed by an attacker generated key whose self-signed certificate is embedded in that response, authenticating an arbitrary assertion.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-03 19:56 UTC
CWE
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| TIMLEGGE | Net::SAML2 |
Affected:
0 , < 0.86
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-18089",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-03T19:56:09.872860Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T19:56:33.033Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://cpan.org/modules",
"defaultStatus": "unaffected",
"packageName": "Net-SAML2",
"product": "Net::SAML2",
"programFiles": [
"lib/Net/SAML2/Role/VerifyXML.pm",
"lib/Net/SAML2/Binding/POST.pm",
"lib/Net/SAML2/Protocol/Assertion.pm"
],
"programRoutines": [
{
"name": "Net::SAML2::Role::VerifyXML::verify_xml"
},
{
"name": "Net::SAML2::Binding::POST::handle_response"
},
{
"name": "Net::SAML2::Protocol::Assertion::_verify_encrypted_assertion"
}
],
"repo": "https://github.com/perl-net-saml2/perl-Net-SAML2",
"vendor": "TIMLEGGE",
"versions": [
{
"lessThan": "0.86",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass by verifying responses against the response-embedded certificate in verify_xml when no trust anchor is configured.\n\nverify_xml in Net::SAML2::Role::VerifyXML runs \"return if !$anchors \u0026\u0026 !$cacert;\" as soon as the XML::Sig check succeeds, and that check uses the X.509 certificate taken from the response\u0027s own dsig:KeyInfo/dsig:X509Certificate element, so an unanchored response is checked only against the key it carries. Binding::POST declares cacert as an optional Maybe[Str] with no default, so a POST binding built without one takes that path, and _verify_encrypted_assertion returns early the same way with \"return $xml unless $cacert;\".\n\nAny caller that constructs Binding::POST or calls Assertion-\u003enew_from_xml without a cacert, cert_text, or anchors argument accepts a response signed by an attacker generated key whose self-signed certificate is embedded in that response, authenticating an arbitrary assertion."
}
],
"impacts": [
{
"capecId": "CAPEC-115",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-115 Authentication Bypass"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-347",
"description": "CWE-347 Improper Verification of Cryptographic Signature",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-295",
"description": "CWE-295 Improper Certificate Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T12:42:08.879Z",
"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
"shortName": "CPANSec"
},
"references": [
{
"tags": [
"release-notes"
],
"url": "https://metacpan.org/release/TIMLEGGE/Net-SAML2-0.88/source/Changes"
},
{
"url": "https://metacpan.org/release/TIMLEGGE/Net-SAML2-0.85/source/lib/Net/SAML2/Role/VerifyXML.pm#L32"
},
{
"url": "https://metacpan.org/release/TIMLEGGE/Net-SAML2-0.85/source/lib/Net/SAML2/Binding/POST.pm#L21"
},
{
"url": "https://metacpan.org/release/TIMLEGGE/Net-SAML2-0.85/source/lib/Net/SAML2/Protocol/Assertion.pm#L84"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to Net::SAML2 0.86 or later, which requires a cacert or cert_text trust anchor before a response or assertion signature is verified."
}
],
"source": {
"discovery": "UNKNOWN"
},
"timeline": [
{
"lang": "en",
"time": "2026-07-31T00:00:00.000Z",
"value": "Version 0.86 released with fix."
},
{
"lang": "en",
"time": "2026-07-31T00:00:00.000Z",
"value": "Version 0.88 released, re-issuing 0.86 with a corrected version number."
}
],
"title": "Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass by verifying responses against the response-embedded certificate in verify_xml when no trust anchor is configured",
"workarounds": [
{
"lang": "en",
"value": "For deployments that cannot upgrade, construct Net::SAML2::Binding::POST, and call Net::SAML2::Protocol::Assertion-\u003enew_from_xml, with a cacert, cert_text, or anchors argument identifying the IdP signing certificate."
}
],
"x_generator": {
"engine": "cpansec-cna-tool 0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
"assignerShortName": "CPANSec",
"cveId": "CVE-2026-18089",
"datePublished": "2026-08-03T12:42:08.879Z",
"dateReserved": "2026-07-28T16:26:10.967Z",
"dateUpdated": "2026-08-03T19:56:33.033Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-17024 (GCVE-0-2026-17024)
Vulnerability from cvelistv5 – Published: 2026-08-20 21:50 – Updated: 2026-08-25 03:56
VLAI
EPSS
VEX
Title
Vulnerabilities in IBM AIX and PowerVM VIOS
Summary
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to improper certificate validation.
Severity
7.7 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-24 00:00 UTC
CWE
- CWE-295 - Improper Certificate Validation
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.ibm.com/support/pages/node/7283858 | vendor-advisorypatch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| IBM | AIX |
Affected:
7.2
Affected: 7.3 cpe:2.3:a:ibm:aix:7.2:*:*:*:*:*:*:* cpe:2.3:a:ibm:aix:7.2.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:aix:7.3:*:*:*:*:*:*:* cpe:2.3:a:ibm:aix:7.3.0:*:*:*:*:*:*:* |
|
| IBM | PowerVM VIOS |
Affected:
4.1
cpe:2.3:a:ibm:powervm_vios:4.1:*:*:*:*:*:*:* cpe:2.3:a:ibm:powervm_vios:4.1.0:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-17024",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-24T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T03:56:03.236Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:ibm:aix:7.2:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:aix:7.2.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:aix:7.3:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:aix:7.3.0:*:*:*:*:*:*:*"
],
"product": "AIX",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "7.2"
},
{
"status": "affected",
"version": "7.3"
}
]
},
{
"cpes": [
"cpe:2.3:a:ibm:powervm_vios:4.1:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:powervm_vios:4.1.0:*:*:*:*:*:*:*"
],
"product": "PowerVM VIOS",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "4.1"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "CVE-2026-14970, CVE-2026-15061, CVE-2026-15078, CVE-2026-15065, CVE-2026-15068 were reported to IBM by Oneconsult AG (https://oneconsult.com/)."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to improper certificate validation.\u003c/p\u003e"
}
],
"value": "IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to improper certificate validation."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-295",
"description": "CWE-295 Improper Certificate Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T21:50:07.941Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://www.ibm.com/support/pages/node/7283858"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003cstrong\u003eA.\u00a0 APARS\u003c/strong\u003e\u003c/p\u003e\u003cp\u003eIBM has assigned the following APARs to this problem:\u003c/p\u003e\u003cdiv\u003e\u003ctable\u003e\u003ccolgroup\u003e\u003ccol/\u003e\u003ccol/\u003e\u003ccol/\u003e\u003ccol/\u003e\u003ccol/\u003e\u003c/colgroup\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003e\u003cstrong\u003eAIX Level\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003eAPAR\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003eAvailability\u00a0\u00a0\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003eSP\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003eKEY\u003c/strong\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e7.2.5\u003c/td\u003e\u003ctd\u003eIJ59566\u003c/td\u003e\u003ctd\u003e08/14/2026\u003c/td\u003e\u003ctd\u003eSP13\u003c/td\u003e\u003ctd\u003ekey_w_apar\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e7.3.2\u003c/td\u003e\u003ctd\u003eIJ59565\u003c/td\u003e\u003ctd\u003e08/14/2026\u003c/td\u003e\u003ctd\u003eSP05\u003c/td\u003e\u003ctd\u003ekey_w_apar\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e7.3.3\u003c/td\u003e\u003ctd\u003eIJ59564\u003c/td\u003e\u003ctd\u003e08/14/2026\u003c/td\u003e\u003ctd\u003eSP03\u003c/td\u003e\u003ctd\u003ekey_w_apar\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e7.3.4\u003c/td\u003e\u003ctd\u003eIJ59563\u00a0\u003c/td\u003e\u003ctd\u003e08/14/2026\u003c/td\u003e\u003ctd\u003eSP02\u003c/td\u003e\u003ctd\u003ekey_w_apar\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003c/div\u003e\u003cp\u003e\u003c/p\u003e\u003cdiv\u003e\u003ctable\u003e\u003ccolgroup\u003e\u003ccol/\u003e\u003ccol/\u003e\u003ccol/\u003e\u003ccol/\u003e\u003ccol/\u003e\u003c/colgroup\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003e\u003cstrong\u003eVIOS Level\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003eAPAR\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003eAvailability\u00a0\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003eSP\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003eKEY\u003c/strong\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e4.1.0\u003c/td\u003e\u003ctd\u003eIJ59565\u003c/td\u003e\u003ctd\u003e08/14/2026\u003c/td\u003e\u003ctd\u003e4.1.0.50\u003c/td\u003e\u003ctd\u003ekey_w_apar\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e4.1.1\u003c/td\u003e\u003ctd\u003eIJ59564\u003c/td\u003e\u003ctd\u003e08/14/2026\u003c/td\u003e\u003ctd\u003e4.1.1.30\u003c/td\u003e\u003ctd\u003ekey_w_apar\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e4.1.2\u003c/td\u003e\u003ctd\u003eIJ59563\u003c/td\u003e\u003ctd\u003e08/14/2026\u003c/td\u003e\u003ctd\u003e4.1.2.20\u003c/td\u003e\u003ctd\u003ekey_w_apar\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003c/div\u003e\u003cp\u003e\u003c/p\u003e\u003cp\u003e\u003cstrong\u003eB.\u00a0 FIXES\u003c/strong\u003e\u003c/p\u003e\u003cp\u003eIBM strongly recommends addressing the vulnerability now.\u003c/p\u003e\u003cp\u003e\u00a0AIX and VIOS fixes are available and can be downloaded from Fix Central: \u003ca href=\"https://www.ibm.com/support/fixcentral\" rel=\"nofollow\"\u003ehttps://www.ibm.com/support/fixcentral\u003c/a\u003e\u003c/p\u003e\u003cp\u003e\u00a0An LPAR reboot is required to complete the SP/FP update. On AIX, Live Update can be used to avoid a reboot.\u003c/p\u003e\u003cp\u003e\u00a0IBM has assigned the following AIX Service Packs (SPs) and VIOS Fix Packs (FPs) as the remediation levels for the published vulnerabilities.\u003c/p\u003e\u003cdiv\u003e\u003ctable\u003e\u003ccolgroup\u003e\u003ccol/\u003e\u003ccol/\u003e\u003c/colgroup\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003e\u003cstrong\u003eAIX Level\u00a0\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003eService Pack\u003c/strong\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eAIX 7.3 TL04\u003c/td\u003e\u003ctd\u003eSP2\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eAIX 7.3 TL03\u003c/td\u003e\u003ctd\u003eSP3\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eAIX 7.3 TL02\u003c/td\u003e\u003ctd\u003eSP5\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eAIX 7.2 TL05\u00a0\u003c/td\u003e\u003ctd\u003eSP13\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003c/div\u003e\u003cp\u003e\u003c/p\u003e\u003cdiv\u003e\u003ctable\u003e\u003ccolgroup\u003e\u003ccol/\u003e\u003ccol/\u003e\u003c/colgroup\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003e\u003cstrong\u003ePowerVM VIOS Level\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003eFix Pack\u003c/strong\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eVIOS 4.1.2\u00a0\u003c/td\u003e\u003ctd\u003e4.1.2.20\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eVIOS 4.1.1\u00a0\u003c/td\u003e\u003ctd\u003e4.1.1.30\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eVIOS 4.1.0\u00a0\u00a0\u003c/td\u003e\u003ctd\u003e4.1.0.50\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003c/div\u003e\u003cp\u003e\u003c/p\u003e\u003cp\u003e\u003cstrong\u003eNote:\u003c/strong\u003e These SPs/FPs are cumulative and include fixes for all previously published AIX/VIOS security vulnerabilities. They can be applied on top of any earlier affected level of the TL .\u003c/p\u003e\u003cp\u003e\u003cstrong\u003eNote:\u003c/strong\u003e To apply these patches using nimsh secure, special steps must be taken as the protocol between master and client is updated to be more secure. Please read this article:\u003cbr/\u003e\u003ca href=\"https://www.ibm.com/support/pages/node/7283157\" rel=\"nofollow\"\u003ehttps://www.ibm.com/support/pages/node/7283157\u003c/a\u003e\u003c/p\u003e\u003cp\u003e\u003cstrong\u003eNote:\u003c/strong\u003e For VIOS 4.1.0 and VIOS 4.1.1, additional steps are required to migrate to the latest Postgres15 after applying the 4.1.1.30 or 4.1.0.50 FPs above. Instructions to do that can be found here:\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\u00a0\u003c/p\u003e\u003cp\u003e\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 4.1.0.50 post-update instructions: \u003ca href=\"https://www.ibm.com/support/pages/node/7283819\" rel=\"nofollow\"\u003ehttps://www.ibm.com/support/pages/node/7283819\u003c/a\u003e\u003cbr/\u003e\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 4.1.1.30 post-update instructions: \u003ca href=\"https://www.ibm.com/support/pages/node/7283823\" rel=\"nofollow\"\u003ehttps://www.ibm.com/support/pages/node/7283823\u003c/a\u003e\u003c/p\u003e\u003cp\u003e\u003c/p\u003e"
}
],
"value": "A.\u00a0 APARS\n\n\n\nIBM has assigned the following APARs to this problem:\n\nAIX LevelAPARAvailability\u00a0\u00a0SPKEY7.2.5IJ5956608/14/2026SP13key_w_apar7.3.2IJ5956508/14/2026SP05key_w_apar7.3.3IJ5956408/14/2026SP03key_w_apar7.3.4IJ59563\u00a008/14/2026SP02key_w_apar\n\n\n\n\n\nVIOS LevelAPARAvailability\u00a0SPKEY4.1.0IJ5956508/14/20264.1.0.50key_w_apar4.1.1IJ5956408/14/20264.1.1.30key_w_apar4.1.2IJ5956308/14/20264.1.2.20key_w_apar\n\n\n\n\n\n\n\nB.\u00a0 FIXES\n\n\n\nIBM strongly recommends addressing the vulnerability now.\n\n\n\n\u00a0AIX and VIOS fixes are available and can be downloaded from Fix Central: https://www.ibm.com/support/fixcentral \n\n\n\n\u00a0An LPAR reboot is required to complete the SP/FP update. On AIX, Live Update can be used to avoid a reboot.\n\n\n\n\u00a0IBM has assigned the following AIX Service Packs (SPs) and VIOS Fix Packs (FPs) as the remediation levels for the published vulnerabilities.\n\nAIX Level\u00a0Service PackAIX 7.3 TL04SP2AIX 7.3 TL03SP3AIX 7.3 TL02SP5AIX 7.2 TL05\u00a0SP13\n\n\n\n\n\nPowerVM VIOS LevelFix PackVIOS 4.1.2\u00a04.1.2.20VIOS 4.1.1\u00a04.1.1.30VIOS 4.1.0\u00a0\u00a04.1.0.50\n\n\n\n\n\n\n\nNote: These SPs/FPs are cumulative and include fixes for all previously published AIX/VIOS security vulnerabilities. They can be applied on top of any earlier affected level of the TL .\n\n\n\nNote: To apply these patches using nimsh secure, special steps must be taken as the protocol between master and client is updated to be more secure. Please read this article:\n https://www.ibm.com/support/pages/node/7283157 \n\n\n\nNote: For VIOS 4.1.0 and VIOS 4.1.1, additional steps are required to migrate to the latest Postgres15 after applying the 4.1.1.30 or 4.1.0.50 FPs above. Instructions to do that can be found here:\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\u00a0\n\n\n\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 4.1.0.50 post-update instructions: https://www.ibm.com/support/pages/node/7283819 \n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 4.1.1.30 post-update instructions: https://www.ibm.com/support/pages/node/7283823"
}
],
"title": "Vulnerabilities in IBM AIX and PowerVM VIOS"
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2026-17024",
"datePublished": "2026-08-20T21:50:07.941Z",
"dateReserved": "2026-07-24T10:21:28.320Z",
"dateUpdated": "2026-08-25T03:56:03.236Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Architecture and Design
Implementation
Certificates should be carefully managed and checked to assure that data are encrypted with the intended owner's public key.
Mitigation
Implementation
If certificate pinning is being used, ensure that all relevant properties of the certificate are fully validated before the certificate is pinned, including the hostname.
CAPEC-459: Creating a Rogue Certification Authority Certificate
An adversary exploits a weakness resulting from using a hashing algorithm with weak collision resistance to generate certificate signing requests (CSR) that contain collision blocks in their "to be signed" parts. The adversary submits one CSR to be signed by a trusted certificate authority then uses the signed blob to make a second certificate appear signed by said certificate authority. Due to the hash collision, both certificates, though different, hash to the same value and so the signed blob works just as well in the second certificate. The net effect is that the adversary's second X.509 certificate, which the Certification Authority has never seen, is now signed and validated by that Certification Authority.
CAPEC-475: Signature Spoofing by Improper Validation
An adversary exploits a cryptographic weakness in the signature verification algorithm implementation to generate a valid signature without knowing the key.