Cloudflare's Universal SSL automatically manages the CAA RRset for customer zones in a permissive manner, overriding any stricter customer-configured CAA records that use RFC 8657 accounturi or validationmethods parameters. Because Certificate Authorities evaluate the served RRset under RFC 8659 without considering these stricter parameters, the intended protections for account-binding and validation-method-binding are not enforced end-to-end. This can lead to misissuance of browser-trusted TLS certificates to attackers, enabling man-in-the-middle attacks. However, exploitation is complex due to the need for an ACME account at an authorized CA and satisfying multi-perspective domain validation across Cloudflare's globally distributed anycast network. Any misissuance would be logged in Certificate Transparency logs, allowing detection. The vulnerability affects Cloudflare's Universal SSL cloud service. Customers requiring strict RFC 8657 enforcement must disable Universal SSL, as the automatic CAA management and strict enforcement are mutually exclusive. Certificate Transparency monitoring is advised as a detection measure.

Successful exploitation could allow an attacker to obtain a browser-trusted TLS certificate for a domain protected by Cloudflare Universal SSL, potentially enabling man-in-the-middle attacks. However, the complexity of exploitation is high due to the need for control over an ACME account at a permitted CA and passing multi-perspective domain validation checks. Any misissuance would be publicly logged in Certificate Transparency logs, providing visibility and detection opportunities.

Cloudflare manages remediation for this cloud-hosted service. Customers requiring strict enforcement of RFC 8657 protections must disable Universal SSL on the affected zone, as there is no in-product workaround that preserves both Universal SSL's automatic CAA management and strict RFC 8657 enforcement. Certificate Transparency monitoring is recommended for all customers to detect any certificate misissuance.