CVE-2026-42784 Sequoia-openpgp: sequoia-openpgp: cryptographic integrity compromise via key flag confusion
Attackers can bypass back-signature checks to forge signatures and bind arbitrary subkeys, compromising cryptographic integrity in applications using this library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-42784?
CVE-2026-42784 is a high-severity vulnerability in Red Hat Confidential Compute Attestation, published on 16 Sep 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A flaw was found in sequoia-openpgp. The library incorrectly infers key flags for older certificates when a key flags subpacket is missing, leading to a discrepancy in how key capabilities are viewed. This key flag confusion allows an attacker to bypass the back-signature check. Consequently, an attacker can illegitimately bind an arbitrary subkey to their own certificate and forge signatures, completely compromising cryptographic integrity.
Weakness: CWE-347
Which versions are affected by CVE-2026-42784?
Linux distribution packages (32)
rpm-sequoia AlmaLinux:10 | All versions | 1.10.2.1-1.el10_2 |
rpm-sequoia-devel AlmaLinux:10 | All versions | 1.10.2.1-1.el10_2 |
sequoia-sq AlmaLinux:10 | All versions | 1.4.0.1-2.el10_2 |
sequoia-sqv AlmaLinux:10 | All versions | 1.3.0.2-1.el10_2 |
rpm-sequoia AlmaLinux:9 | All versions | 1.10.2.1-1.el9_8 |
rpm-sequoia-devel AlmaLinux:9 | All versions | 1.10.2.1-1.el9_8 |
rpm-sequoia Red Hat:enterprise_linux:10.2 | All versions | 0:1.10.2.1-1.el10_2 |
rpm-sequoia-debuginfo Red Hat:enterprise_linux:10.2 | All versions | 0:1.10.2.1-1.el10_2 |
rpm-sequoia-devel Red Hat:enterprise_linux:10.2 | All versions | 0:1.10.2.1-1.el10_2 |
rust-rpm-sequoia Red Hat:enterprise_linux:10.2 | All versions | 0:1.10.2.1-1.el10_2 |
rust-rpm-sequoia-debugsource Red Hat:enterprise_linux:10.2 | All versions | 0:1.10.2.1-1.el10_2 |
rust-sequoia-sq Red Hat:enterprise_linux:10.2 | All versions | 0:1.4.0.1-2.el10_2 |
rust-sequoia-sq-debugsource Red Hat:enterprise_linux:10.2 | All versions | 0:1.4.0.1-2.el10_2 |
rust-sequoia-sqv Red Hat:enterprise_linux:10.2 | All versions | 0:1.3.0.2-1.el10_2 |
rust-sequoia-sqv-debugsource Red Hat:enterprise_linux:10.2 | All versions | 0:1.3.0.2-1.el10_2 |
sequoia-sq Red Hat:enterprise_linux:10.2 | All versions | 0:1.4.0.1-2.el10_2 |
sequoia-sq-debuginfo Red Hat:enterprise_linux:10.2 | All versions | 0:1.4.0.1-2.el10_2 |
sequoia-sqv Red Hat:enterprise_linux:10.2 | All versions | 0:1.3.0.2-1.el10_2 |
sequoia-sqv-debuginfo Red Hat:enterprise_linux:10.2 | All versions | 0:1.3.0.2-1.el10_2 |
rpm-sequoia Red Hat:enterprise_linux:9::baseos | All versions | 0:1.10.2.1-1.el9_8 |
rpm-sequoia-debuginfo Red Hat:enterprise_linux:9::baseos | All versions | 0:1.10.2.1-1.el9_8 |
rust-rpm-sequoia Red Hat:enterprise_linux:9::baseos | All versions | 0:1.10.2.1-1.el9_8 |
rust-rpm-sequoia-debugsource Red Hat:enterprise_linux:9::baseos | All versions | 0:1.10.2.1-1.el9_8 |
rpm-sequoia-debuginfo Red Hat:enterprise_linux:9::crb | All versions | 0:1.10.2.1-1.el9_8 |
rpm-sequoia-devel Red Hat:enterprise_linux:9::crb | All versions | 0:1.10.2.1-1.el9_8 |
rust-rpm-sequoia-debugsource Red Hat:enterprise_linux:9::crb | All versions | 0:1.10.2.1-1.el9_8 |
podman-sequoia Red Hat:hummingbird:1 | All versions | 0:0.3.2-4.hum1 |
rust-podman-sequoia Red Hat:hummingbird:1 | All versions | 0:0.3.2-4.hum1 |
rust-rpm-sequoia Rocky Linux:10 | All versions | 0:1.10.2.1-1.el10_2 |
rust-sequoia-sq Rocky Linux:10 | All versions | 0:1.4.0.1-2.el10_2 |
rust-sequoia-sqv Rocky Linux:10 | All versions | 0:1.3.0.2-1.el10_2 |
rust-rpm-sequoia Rocky Linux:9 | All versions | 0:1.10.2.1-1.el9_8 |
How do I fix CVE-2026-42784?
Apply the vendor's patch.
Is CVE-2026-42784 being exploited?
There is no known exploitation of CVE-2026-42784 in the wild and no public exploit code.
Sources
Also known as ALSA-2026:76733, ALSA-2026:76734, ALSA-2026:76735, ALSA-2026:76737, AZL-105170, DEBIAN-CVE-2026-42784 and 11 more.