The vulnerability CVE-2026-33308 affects mod_gnutls, a TLS module for Apache HTTPD that leverages GnuTLS for secure communications. Before version 0.13.0, the module's client certificate verification process failed to validate the Extended Key Usage (EKU) extension properly, specifically the key purpose field. This allowed certificates issued by a trusted CA but intended for other purposes (e.g., server authentication or code signing) to be accepted as valid client authentication certificates. An attacker possessing the private key corresponding to such a certificate could bypass intended access controls that rely on TLS client authentication, potentially gaining unauthorized access to sensitive resources. The vulnerability does not affect server configurations that do not require client certificates (default setting). The fix in version 0.13.0 involves rewriting the verification logic to use the gnutls_certificate_verify_peers() function, which enforces the presence of the id-kp-clientAuth EKU by default when the extension is present. Administrators can override this behavior with the new GnuTLSClientKeyPurpose option if necessary. Certificates lacking an EKU extension remain unaffected by this change. The vulnerability is classified under CWE-295 (Improper Certificate Validation) and has a CVSS v3.1 base score of 6.8, reflecting a medium severity with high confidentiality impact but no impact on integrity or availability. No public exploits have been reported to date.

This vulnerability can lead to unauthorized access to systems relying on TLS client authentication, potentially exposing sensitive data or services to attackers who possess a valid certificate private key issued for a different purpose. The confidentiality of protected resources is at risk, as attackers can impersonate legitimate clients without possessing a properly purposed certificate. Although the vulnerability does not affect server availability or data integrity directly, the breach of confidentiality can have significant operational and reputational consequences. Organizations using mod_gnutls versions prior to 0.13.0 with client certificate authentication enabled are at risk, especially if they do not segregate certificate issuance by purpose or rely on multi-purpose certificates. The lack of known exploits reduces immediate risk, but the vulnerability's nature makes it a candidate for targeted attacks in environments where client certificate authentication is critical.

Upgrade mod_gnutls to version 0.13.0 or later, which includes the fix enforcing proper Extended Key Usage validation. Review and enforce strict certificate issuance policies to ensure that client certificates are issued only by dedicated CAs or sub-CAs specifically for client authentication purposes. Configure the GnuTLSClientKeyPurpose option carefully if custom key purposes are required, ensuring they align with security policies. Audit existing client certificates to identify any that may be misused due to improper EKU settings and revoke or reissue them as necessary. Implement monitoring and logging of TLS client authentication attempts to detect anomalous usage patterns. Consider additional layers of authentication or authorization beyond TLS client certificates to reduce reliance on certificate EKU enforcement alone. Regularly review and test TLS configurations to ensure compliance with best practices and to detect potential misconfigurations.