EUVD-2026-109299
GHSA-x547-2835-q547
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain compromised eMudhra CA cert/key material
-
DeliveryGain MITM or server-impersonation position on victim path
-
ExploitPresent malicious chain to CPython ssl client
-
ExecutionClient accepts distrusted certificate as valid
-
ImpactIntercept, decrypt and alter TLS-protected data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V12 - Secure Communication Certificate revocation checking
|
| Exploitation Conditions | Exploitation requires (1) an attacker in possession of certificate/key material chaining to the compromised eMudhra CA, and (2) a man-in-the-middle or server-impersonation position so the victim's Python process connects to attacker-controlled TLS; the affected condition is any CPython ssl/TLS client relying on default validation without certificate revocation (OCSP/CRL) configured - which is CPython's default. The key limiting factors are the need for the compromised CA's key material and a privileged network/path position, which make this targeted rather than opportunistic; the denylist fix rejects these certificates even when the SSLContext would otherwise accept them. |
| Impact | The input assigns a 9.4 CVSS 4.0 (Critical) score, and the vendor priority label is act_now, which signals urgency. However, the strongest real-world exploitation signals are weak or absent: there is no CISA KEV listing in the provided data (so this is not confirmed actively exploited), no EPSS probability was supplied, and no working exploit reference is present - only the patch PR, the tracking issue, an oss-security post, and a vendor advisory, giving 'no public exploit identified at time of analysis.' The underlying flaw (CWE-299, improper handling of a compromised/distrusted certificate authority - the eMudhra CA) is serious because CPython performs no certificate revocation checking by default, so a trusted-but-compromised CA certificate would be accepted; but practical exploitation is constrained, requiring the attacker to both possess key material from the compromised eMudhra CA and occupy a man-in-the-middle or server-impersonation position, making this targeted rather than widespread or wormable. Two signals in the supplied vector should be treated with caution: the availability impact (VA:H / SC:SI:SA:H subsequent-system highs) appears inflated for a certificate-distrust/TLS-interception issue, which realistically compromises confidentiality and integrity of the TLS channel, not availability - verify the impact metrics against the vendor advisory before treating the 9.4 as a faithful representation of this bug. |
| Exploit ScenarioDerived | An attacker who holds certificate/key material issued under the compromised eMudhra CA positions themselves on the network path between a Python client and a target server (or lures the client to an attacker-controlled endpoint). Because CPython's ssl module performed no revocation/distrust check by default, the client accepts the malicious chain as valid, letting the attacker decrypt and alter the supposedly protected TLS traffic. No public exploit was identified at time of analysis; the only released code is the fix and its test fixtures. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 24, 2026
CPython's ssl module validates TLS certificate chains that anchor to known-compromised eMudhra CA certificates, so anyone holding that CA's key material can impersonate arbitrary TLS servers to unpatched Python clients. Every Python application that relies on the default verification path (ssl.create_default_context() or an SSLContext without its own OCSP/CRL checking) is affected, which is CPython's default behaviour; the fix adds a hard-coded denylist of distrusted certificates enforced regardless of SSLContext policy. Exploitation is targeted rather than opportunistic, requiring the compromised CA key plus a man-in-the-middle or server-impersonation position against the victim's connection; no public exploit identified at time of analysis, and the vendor-tracked priority label is act_now.
RemediationAI
Upstream fix available (PR/commit); released patched version not independently confirmed - the vendor marks a patch as available and the enforcement change is in https://github.com/python/cpython/pull/160042 (tracked as https://github.com/python/cpython/issues/160040), so consult the python.org security-announce advisory at https://mail.python.org/archives/list/security-announce@python.org/thread/FNAJMZV6XQYLVPABNINDMF3VF66AYLW4/ to identify the exact maintenance release for each CPython branch you run and upgrade to it; there is no runtime configuration switch in unpatched builds that reproduces the denylist. Until an interpreter upgrade can be shipped, the same effect can be approximated in application code by loading an explicit trust bundle that omits the affected eMudhra roots (SSLContext.load_verify_locations or the cafile argument to ssl.create_default_context), with the trade-off that the bundle must be packaged and maintained with the application and will also break any legitimate dependency on those roots. Enabling explicit revocation checking (OCSP or CRL via load_verify_locations/VERIFY_CRL_CHECK flags where OpenSSL supports it) or certificate pinning for high-value endpoints provides equivalent rejection of the compromised chain, at the cost of added handshake latency and OCSP availability dependencies for revocation checks, and of operational churn whenever a pinned certificate rotates. Because the attack requires an on-path position, constraining egress to known endpoints reduces exposure but does not fix the validator. CPython's CPE wildcard means the exposure assessment should start from an inventory of which interpreter builds and which TLS clients actually use the stdlib ssl verification path.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-299, Improper Check for Certificate Revocation. CPython's ssl module delegates chain building and validation to OpenSSL and, by default, performs no OCSP or CRL revocation checking, so a certificate chain that is otherwise valid but terminates in a distrusted or compromised CA is accepted until that CA is explicitly removed from trust. The identifier here is the compromise of eMudhra CA material (the reference https://emudhra.we-have-a-problem.com/ tracks that incident): once an intermediate CA key is known, certificates it signs are indistinguishable from legitimate ones to a validator that only checks signatures and validity periods. Notably, the test fixture added in the upstream change reconstructs the distrusted intermediate's secp384r1 private key from a trivially small scalar rather than carrying the key itself, which is consistent with the compromised key being derivable from weak key generation rather than merely stolen. The fix implements a denylist of known-compromised certificates/public keys inside the _ssl extension so that verification rejects such chains even when the surrounding SSLContext policy configuration would otherwise accept them; the accompanying tests load a leaf signed by the compromised intermediate whose chain to the bundled root is otherwise valid and assert that verification fails.
Know when Python gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Network TLS interception needs compromised-CA material plus a MITM position (AC:H) and a victim-initiated connection (UI:R), breaking confidentiality and integrity of the channel (C:H/I:H) with no availability impact (A:N).
Primary rating from Vendor (PSF).
CVSS VectorVendor: PSF
DescriptionCVE.org
Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configuration.
Articles & Coverage 1
Executive ViewAI
CVE-2026-115557 in CPython's ssl module allows attackers with compromised eMudhra CA key material to impersonate any TLS server to unpatched Python clients, undermining trust in encrypted communications across applications built on default Python SSL contexts. This affects the integrity of all Python-dependent services and data in transit, potentially exposing sensitive information and enabling targeted man-in-the-middle attacks. Leadership should prioritize remediation to maintain customer trust and regulatory compliance.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution affects Kestra OSS (the open-source event-driven orchestration platform) prior to
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Exploit-DB