CVE-2026-71886 OpenPGP certification accepted from a subkey without certification authority
Attackers can exploit compromised subkeys to forge OpenPGP certifications, bypassing key flag restrictions and falsely attributing identity assertions to the primary key.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-71886?
CVE-2026-71886 is a high-severity authentication bypass vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA, published on 3 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Bouncy Castle for Java before 1.86, the high-level OpenPGP certificate API accepted a third-party certification or trust delegation from any component key of the issuing certificate, without requiring that component to have been granted the authority to certify. OpenPGPCertificate.getCertificationBy() and getDelegationBy() resolve a third-party signature by matching its issuer key identifier against every key of the third-party certificate, then verify the issuing component's binding chain and the signature itself; nothing checked that the issuing component carried the RFC 9580 sec. 5.2.3.29 certification key flag (CERTIFY_OTHER) when the signature was created. A subkey bound only with SIGN_DATA - the online signing subkey of exactly the offline-primary arrangement those key flags exist to express - could therefore issue a positive User ID certification over an attacker-controlled identity, or a full-trust depth-one direct-key delegation of introducer trust, and the API returned it as a valid signature chain attributed to the third-party certificate. An application treating getCertificationBy(...).isValid() or getDelegationBy(...) as an identity or trusted-introducer decision would attribute the attacker's assertion to the offline primary key. The same held for a legacy RSA subkey bound only for encryption, whose algorithm is nonetheless able to sign. This does not forge the primary key's signature or recover any private key; it promotes an already-compromised restricted subkey to the primary key's identity-issuing authority, defeating the containment the key-flag separation provides. A third-party certification or delegation is now attributed to the issuing certificate only when the component key that made it is the primary key, or is a subkey holding CERTIFY_OTHER when the signature was created, so certification-capable subkeys continue to be accepted; primary keys are accepted whatever their key flags say, since a primary key is certification-capable by construction and certificates carrying no key flags subpacket at all are common. Third-party revocations are deliberately outside the rule, since declining to honour one would keep trust alive rather than withdraw it.
Which versions are affected by CVE-2026-71886?
How do I fix CVE-2026-71886?
Upgrade to a fixed version.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-71886 being exploited?
There is no known exploitation of CVE-2026-71886 in the wild and no public exploit code.
Sources
Also known as CLEANSTART-2026-WJ50656, DEBIAN-CVE-2026-71886, GHSA-7hrr-mw36-px4x, UBUNTU-CVE-2026-71886.