{"answers":{"affected":"It affects 1 product.","exploited":"There is no known exploitation of CVE-2026-42769 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-42769 is a medium-severity authentication bypass vulnerability in Openssl Openssl, published on 9 Jun 2026. Any signed-in user can exploit it over the network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-42769 and fix it if it is affected.\n\nWhat it is: CVE-2026-42769 is a medium-severity authentication bypass vulnerability in Openssl Openssl, published on 9 Jun 2026. Any signed-in user can exploit it over the network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-42769 in the wild and no public exploit code.\n\nAffected product: Openssl Openssl. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-42769/ (Markdown: https://insights.sbomify.com/CVE-2026-42769/index.md)","id":"CVE-2026-42769","markdown":"https://insights.sbomify.com/CVE-2026-42769/index.md","name":"CVE-2026-42769","record":{"aliases":["ALPINE-CVE-2026-42769","AZL-92840","BELL-CVE-2026-42769","CLSA-2026-1782386492","DEBIAN-CVE-2026-42769","GHSA-rpj2-p5pj-r33v","JLSEC-2026-1141","MINI-9pw9-7q9c-mmjj","UBUNTU-CVE-2026-42769"],"analysis":{"component_type":"library","fix_type":"patch","impacts":["privilege_escalation","security_bypass"],"network_reachable":"yes","non_default_config":false,"product_category":"OpenSSL cryptographic library","requires_auth":"low_privilege","summary":"A typo in OpenSSL's CMP root CA key update verification allows a Registration Authority to substitute the root CA trust anchor, escalating privileges to root CA level.","user_interaction":"not_required","vuln_class":"auth_bypass"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"openssl","cpe":[{"product":"openssl","vendor":"openssl"}],"cvss":{"score":5.3,"severity":"medium","source":"cisa-adp","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"cwes":[{"id":"CWE-295","name":"Improper Certificate Validation"}],"description":"Issue Summary: An error in the callback used to verify the certificate\nprovided in a Root CA key update Certificate Management Protocol (CMP)\nmessage response rendered the certificate validation ineffectual, which\ncould lead to escalation of credentials from the Registration Authority (RA)\nlevel to the root Certification Authority (root CA) level.\n\nImpact Summary: The Registration Autority could replace the root CA\ncertificate for the CMP clients with an arbitrary root CA certificate.\n\nOne of the parts of the Certificate Management Protocol (CMP), specified in\nRFC 9810, is Root Certification Authority (root CA) key Rollover,\nwhich is sent by the server in a message with type 'id-it-rootCaKeyUpdate'.\nAs part of these messages, 'newWithOld' certificate, the new root CA\ncertificate signed with the old root CA key, is provided, and verifying its\nsignature is crucial for transferring the trust from the old CA key to the\nnew one.\n\nThe 'id-it-rootCaKeyUpdate' messages are expected to be processed with\nOSSL_CMP_get1_rootCaKeyUpdate(), that is expected to verify the 'newWithOld'\ncertificate.  A typo in the certificate chain building code led to adding\nan incorrect certificate ('newWithOld' instead of 'oldRoot') to the\ncertificate chain, rendering the certificate verification process ineffectual\n(only the issuer name and the algorithm OIDs were verified by other parts\nof the verification code).\n\nAn attacker who already has credentials that satisfy the CMP message\nprotection checks can generate a new key pair and use a crafted self-signed\ncertificate in its 'id-it-rootCaKeyUpdate' CMP messages which affected CMP\nclients would accept as a new trust anchor.\n\nSignificant preconditions for the attack (having valid RA-level credentials)\nare the reason the issue was assigned Low severity.\n\nThe FIPS modules are not affected by this issue, as the affected code is\noutside the OpenSSL FIPS module boundary.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"Trust-Anchor Substitution via cert/issuer Typo in CMP rootCaKeyUpdate","id":"CVE-2026-42769","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":"openssl:openssl","products":["openssl:openssl"],"type":"auth_bypass","year":"2026"},"n_packages":0,"n_references":5,"next":{"headline":"FFC-DH Peer Validation Uses Attacker-Supplied q","id":"CVE-2026-42770"},"packages":[],"prev":{"headline":"Multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and PKCS7_decrypt()","id":"CVE-2026-42768"},"products":["OpenSSL"],"published":"2026-06-09","related":[{"cvss_score":10,"headline":"Null dereference in n/a","id":"CVE-2009-3245","kev_date_added":null,"published":"2010-03-05"},{"cvss_score":10,"headline":"Memory corruption in n/a","id":"CVE-2006-3738","kev_date_added":null,"published":"2006-09-28"},{"cvss_score":9.8,"headline":"Untrusted Sender DN Used as Format String in CMP Response Validation","id":"CVE-2026-63073","kev_date_added":null,"published":"2026-08-25"},{"cvss_score":9.8,"headline":"Use after free in n/a","id":"CVE-2016-6309","kev_date_added":null,"published":"2016-09-26"},{"cvss_score":9.8,"headline":"Integer overflow in n/a","id":"CVE-2016-0799","kev_date_added":null,"published":"2016-03-03"},{"cvss_score":9.8,"headline":"Memory corruption in n/a","id":"CVE-2016-2842","kev_date_added":null,"published":"2016-03-03"},{"cvss_score":9.8,"headline":"Memory corruption in n/a","id":"CVE-2003-0545","kev_date_added":null,"published":"2003-10-01"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-06-10","vendors":["OpenSSL"]},"summary":"A typo in OpenSSL's CMP root CA key update verification allows a Registration Authority to substitute the root CA trust anchor, escalating privileges to root CA level.","url":"https://insights.sbomify.com/CVE-2026-42769/"}