CWE-295 vulnerabilities

Elixir WebRTC is an Elixir implementation of the W3C WebRTC API. Prior to 0.15.1 and 0.16.1, missing DTLS peer certificate fingerprint validation in the DTLS client (active) role removes one side of WebRTC's mutual authentication. The bug is not independently exploitable for media interception in standard deployments, but enables a full man-in-the-middle attack when chained with insecure signalling or a peer with similar validation gaps. This vulnerability is fixed in 0.15.1 and 0.16.1.

Fleet is open source device management software. Prior to version 4.81.0, a vulnerability in Fleet’s Windows MDM management endpoint could allow requests to be processed without proper client certificate validation. In certain circumstances, this could allow an attacker to impersonate an enrolled Windows device and retrieve sensitive configuration data. Fleet’s Windows MDM management endpoint relies on mutual TLS (mTLS) client certificates to authenticate enrolled devices. In affected versions, requests that did not present a client certificate could be incorrectly treated as trusted. As a result, an attacker with prior knowledge of a valid enrolled device identifier could potentially impersonate that device and receive configuration payloads intended for it. These payloads may contain sensitive information such as Wi-Fi or VPN configuration data, certificates, or other secrets delivered through MDM profiles. This issue does not allow enrollment of new devices, administrative access to Fleet, or compromise of the Fleet control plane. Impact is limited to the targeted Windows device. Version 4.81.0 contains a patch. If an immediate upgrade is not possible, affected Fleet users should temporarily disable Windows MDM.

css_parser is a Ruby CSS parser. Prior to 2.1.0 and 1.22.0, the CSS Parser gem does not validate HTTPS connections, allowing a Man-in-the-Middle (MITM) attacker to inject or modify CSS content when stylesheets are loaded via HTTPS. The connection is established with OpenSSL::SSL::VERIFY_NONE, meaning any HTTPS certificate—even entirely untrusted—will be accepted without validation. This vulnerability is fixed in 2.1.0 and 1.22.0.

CVE-2026-32992 is a high-severity vulnerability in WebPros cPanel affecting multiple versions where SSL verification is disabled in the DNS Cluster system. This improper certificate validation (CWE-295) could allow a malicious server to perform a man-in-the-middle attack and capture credentials. There is no official patch or remediation level currently provided by the vendor. The vulnerability has not been reported as exploited in the wild.

MISP misp-modules versions prior to 3.0.7 contain vulnerabilities related to improper certificate validation and unsafe remote resource fetching. Specifically, the html_to_markdown module allowed Server-Side Request Forgery (SSRF) via arbitrary HTTP(S) URLs without sufficient validation, potentially targeting internal network resources. The qrcode module disabled TLS certificate verification when retrieving remote images, exposing requests to man-in-the-middle attacks. These issues were addressed in version 3.0.7 by enforcing URL scheme validation, blocking local/private addresses, resolving hostnames before fetching, enforcing request timeouts, and re-enabling TLS certificate verification.

An improper certificate validation vulnerability in the Prisma Access Agent® for Android and Chrome OS enables an attacker to perform a man-in-the-middle (MitM) attack to intercept VPN traffic. By presenting a certificate for any domain issued by a trusted Certificate Authority, the attacker can capture sensitive device information. The Prisma Access Agent on macOS, Windows, Linux and iOS are not affected.

An improper certificate validation vulnerability in the Palo Alto Networks Prisma SD-WAN ION enables man-in-the-middle (MitM) attacker to impersonate the controller.

Multiple improper certificate validation vulnerabilities in the Palo Alto Networks GlobalProtect™ app enables an attacker to intercept encrypted communications and potentially compromise the endpoint. This can enable a local non-administrative operating system user or an attacker on the same subnet to redirect traffic to an unauthorized server and facilitate the installation of malicious software. The GlobalProtect app on Linux, Windows, iOS and GlobalProtect UWP app are not affected.

CVE-2026-8367 is a medium severity vulnerability in aria2c where the client accepts server certificates with incorrect Extended Key Usage (EKU). This improper certificate validation could allow an attacker who has compromised a certificate issued for a different purpose to reuse it for TLS server authentication. The vulnerability has a CVSS score of 4.8, indicating limited impact on confidentiality and integrity with no impact on availability. There is no information about an available patch or official remediation at this time.

Lemur manages TLS certificate creation. Prior to 1.9.0, when LDAP TLS is enabled (LDAP_USE_TLS = True), Lemur's LDAP authentication module unconditionally disables TLS certificate verification at the global ldap module level. This allows a man-in-the-middle attacker positioned between Lemur and the LDAP server to intercept all authentication credentials. This vulnerability is fixed in 1.9.0.

CVE-2026-42312 is a vulnerability in pyLoad, a Python-based download manager, affecting versions prior to 0.5.0b3.dev100. It allows any authenticated user with non-admin SETTINGS permission to disable SSL certificate verification by setting the 'general.ssl_verify' option to off, which is not properly restricted by the application's allowlist. This results in outbound pycurl requests bypassing TLS peer and hostname verification, enabling an on-path attacker to present forged certificates. The issue is a continuation of a series of similar flaws in the same allowlist and is fixed in version 0.5.0b3.dev100.

SolidCAM-GPPL-IDE is an unofficial, independently developed extension, Postprocessor IDE for SolidCAM. From version 1.0.0 to before version 1.0.2, the inc "filename" directive in GPPL postprocessor files is resolved by GpplDocumentLinkHandler into a clickable link (VS Code textDocument/documentLink). The handler accepted arbitrary paths — absolute, relative with parent-directory segments (..\..\..\), UNC (\\server\share\), and arbitrary subfolders — and called File.Exists on each to decide whether to render the link. Two distinct attack surfaces resulted: information disclosure via File.Exists probing and NTLM hash leak via UNC path probing. This issue has been patched in version 1.0.2.

CVE-2026-42225 is a high-severity vulnerability in the pjsip pjproject library prior to version 2.17. On GnuTLS builds, the SIP TLS transport component can accept connections with invalid or untrusted certificates even when certificate verification is explicitly enabled. This improper certificate validation issue is identified as CWE-295. The vulnerability has been patched in version 2.17. No known exploits in the wild have been reported.

CVE-2026-42011 is a vulnerability in the GnuTLS library where permitted name constraints were incorrectly ignored if previous Certificate Authorities only had excluded name constraints. This flaw allows a remote attacker to bypass critical name constraint checks during certificate validation, potentially leading to acceptance of invalid certificates. Such acceptance could enable spoofing or man-in-the-middle attacks. Red Hat has issued a security advisory with a fix for this vulnerability in their Extended Life Cycle Support 7 packages.

An Improper Certificate Validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unauthenticated attacker to impersonate registered Sentry hosts and obtain valid CA-signed client certificates.

Improper certificate validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unauthenticated attacker to enroll a device belonging to a restricted set of unenrolled devices, leading to information disclosure about EPMM appliance and impacting on the integrity of the newly enrolled device identity.

Incus is a system container and virtual machine manager. In versions before 7.0.0, broken TLS validation logic in the OVN database connection logic can allow connections to an attacker's OVN database. The OVN client implementations disable Go standard TLS server verification and replace it with custom peer-certificate verification logic. That replacement verifier does not anchor trust in the configured CA certificate. Instead, it constructs the verification root set from certificates supplied by the peer during the handshake, so the configured CA is parsed but not used as the trust anchor for the final verification decision. In OVN-enabled deployments that use these SSL database connection paths, an attacker able to impersonate or intercept the OVN endpoint on the management network can present a rogue self-signed certificate chain, and Incus will accept this certificate as valid. This issue defeats the intended CA-based trust model for OVN database connections and permits endpoint impersonation by an active attacker in a suitable network position. This issue is fixed in version 7.0.0.

The multicluster engine for Kubernetes v2.11 images The multicluster engine for Kubernetes provides the foundational components that are necessary for the centralized management of multiple Kubernetes-based clusters across data centers, public clouds, and private clouds. You can use the engine to create new Red Hat OpenShift Container Platform clusters or to bring existing Kubernetes-based clusters under management by importing them. After the clusters are managed, you can use the APIs that are provided by the engine to distribute configuration based on placement policy.

RouterOS provides various services that rely on correct verification of client and server certificates to secure confidentiality and integrity of communications. This includes OpenVPN, CAPsMAN, Dot1x (802.1X), among others. The vulnerability lies in shared certificate validation logic which uses the system certificate store that is shared and equally trusted by all system services. This causes confusion of scope, allowing any certificate authority present in the system-wide trust store to be trusted in any context (with some exceptions), allowing partial or full authentication bypass in CAPsMAN, OpenVPN, Dot1X and potentially others.

Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.