CVE-2026-103503: CWE-295 Improper Certificate Validation in hexpm hex

The vulnerability in hexpm hex involves improper certificate validation related to the handling of the cacerts_path option, which specifies a custom CA certificate store. Although Hex.HTTP.SSL.ssl_opts/1 uses the configured CA store, the partial_chain callback is always built from the bundled CA store. This causes Hex.HTTP.SSL.partial_chain/2 to accept server certificate chains if any certificate in the chain has the same public key as a bundled CA certificate, effectively bypassing the configured CA store restrictions. This allows an attacker who can intercept HTTPS connections and possesses a certificate from a bundled CA (not trusted in the configured store) to impersonate a Hex host to clients using the vulnerable versions. Hostname verification is still applied, limiting some attack vectors. The affected versions are >=0.20.2 and <2.5.2.

An attacker capable of intercepting HTTPS traffic and holding a certificate issued by a CA included in Hex's bundled CA store (but excluded from the user-configured CA store) can impersonate a Hex host to clients that use the vulnerable versions and set cacerts_path to exclude that CA. This undermines the trust model of TLS connections in these scenarios, potentially leading to man-in-the-middle attacks. However, hostname verification still applies, which reduces the attack surface. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should be cautious when setting cacerts_path to a CA store that excludes CAs present in Hex's bundled store. Monitoring vendor communications for updates or patches is recommended.