Skip to main content
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Recon
    Compromise subordinate CA in certificate hierarchy
  2. Delivery
    Craft certificate with name constraints violation
  3. Exploit
    Position CA after excluded-only constraint CAs
  4. Install
    Present malicious certificate to GnuTLS client
  5. C2
    Bypass validation logic
  6. Execute
    Establish man-in-the-middle TLS session
  7. Impact
    Intercept sensitive communications

Vulnerability Assessment

Weakness
CWE
CWE-295
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V12 - Secure Communication Certificate validation
Exploitation Conditions

Exploitation requires the target system to validate a certificate chain where an earlier Certificate Authority specifies only excluded name constraints (using the Name Constraints X.509 extension with excludedSubtrees) and a subsequent CA in the chain specifies permitted name constraints (permittedSubtrees). The attacker must control or compromise a Certificate Authority that is trusted by the target system and positioned appropriately in this chain structure. Victim systems must use GnuTLS library for TLS certificate validation - applications linked against OpenSSL, NSS, or other TLS libraries are not affected. The attack vector is network-based (AV:N) requiring no authentication (PR:N) or user interaction (UI:N), but high attack complexity (AC:H) reflects that establishing the prerequisite CA control and certificate chain structure is non-trivial. Default RHEL configurations are vulnerable if they process certificates with this specific constraint pattern, but exploitation is limited by the attacker's ability to present a trusted certificate chain meeting the constraint ordering requirement.
Impact

The CVSS 7.4 score reflects high confidentiality and integrity impact with network attack vector but high attack complexity (AC:H), requiring no privileges or user interaction. The high complexity stems from the attacker needing control over a Certificate Authority in a specific position within the certificate chain - specifically, a CA that appears after CAs with only excluded constraints. This is not a trivial condition: attackers must either compromise an existing subordinate CA, establish a rogue CA trusted by the target system, or exploit a separate CA compromise vulnerability. The CVSS vector (S:U) confirms impact is contained to the vulnerable component, not extended systems. No EPSS score, KEV status, or POC availability data provided - absence of KEV listing and public exploit suggests this is not yet under widespread or automated exploitation. However, the authentication bypass tag and man-in-the-middle attack potential make this a genuine risk for high-security environments, government networks, and financial institutions where certificate validation is a critical security boundary. The vulnerability is particularly concerning in Red Hat OpenShift Container Platform 4 environments where service mesh and internal certificate authorities are common. Real-world risk is moderate-to-high for organizations using complex certificate hierarchies with name constraints, but lower for standard configurations with simple two-tier PKI. Prioritization should focus on RHEL systems exposed to untrusted networks or hosting sensitive services where TLS certificate validation is the primary access control mechanism.
Exploit ScenarioDerived

An attacker compromises or establishes a subordinate Certificate Authority positioned in a certificate chain after a CA with only excluded name constraints. The attacker issues a TLS certificate for a sensitive internal domain (e.g., payroll.victim.com) that should be prohibited by a parent CA's permitted name constraints. When a GnuTLS-based client (web browser, API client, container orchestration system) connects to the attacker's server presenting this certificate, the library incorrectly validates the certificate as legitimate due to the ignored permitted constraints. The attacker successfully performs a man-in-the-middle attack, intercepting credentials or sensitive data. This scenario is particularly viable in corporate environments with multi-tier PKI or compromised intermediate CAs in public certificate transparency logs.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – May 07, 2026

Certificate validation in GnuTLS can be bypassed when a certificate chain contains Certificate Authorities with only excluded name constraints followed by CAs with permitted name constraints. Remote attackers can exploit this flaw (CVSS 7.4, AV:N/AC:H) to present invalid certificates that pass validation, enabling man-in-the-middle attacks or service impersonation against TLS-protected communications. The vulnerability affects Red Hat Enterprise Linux versions 6-10, OpenShift Container Platform 4, and Red Hat Hardened Images. No public exploit or active exploitation confirmed at time of analysis, though the technical nature suggests targeted attacks against high-value certificate infrastructure are feasible.

RemediationAI

Apply vendor-released patches for GnuTLS through Red Hat's standard update channels (yum/dnf update gnutls). Consult the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-42011 and Red Hat Bugzilla 2467437 for release-specific fixed package versions. For RHEL 6-10 systems, run 'yum update gnutls' or 'dnf update gnutls' followed by service restarts for applications using the library (httpd, nginx, curl, wget, email servers, VPN services). OpenShift Container Platform 4 administrators should apply cluster updates per Red Hat's OpenShift security bulletins and rebuild container images based on updated Red Hat Universal Base Images. Until patches are applied, compensating controls include: restricting TLS connections to well-known Certificate Authorities by explicitly configuring trust anchors (removes attacker's ability to introduce rogue CAs); implementing certificate pinning for critical internal services (bypasses CA validation entirely but requires maintenance); deploying TLS inspection proxies with non-GnuTLS validation libraries as a second validation layer (adds operational complexity and potential performance impact). These mitigations do not eliminate risk but reduce attack surface by limiting the certificate chains that can reach the vulnerable code path. Organizations using complex PKI hierarchies with name constraints should prioritize patching as workarounds are operationally difficult.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

GnuTLS is a widely-deployed open-source TLS/SSL library implementing secure communications protocols. This vulnerability stems from CWE-295 (Improper Certificate Validation), specifically in the name constraints extension (RFC 5280 Section 4.2.1.10) processing logic. Name constraints allow Certificate Authorities to restrict the namespaces (DNS domains, IP ranges, email domains) for which subordinate CAs can issue certificates. The flaw occurs during certificate chain validation when earlier CAs in the chain specify only excluded name constraints (e.g., 'cannot issue for *.internal.example.com') but later CAs specify permitted constraints (e.g., 'can only issue for *.example.com'). The GnuTLS validator incorrectly ignores the permitted constraints from the later CA when building the intersection of allowed namespaces, treating the absence of permitted constraints in earlier CAs as an implicit 'permit all.' This allows attackers who compromise or control a subordinate CA to issue certificates for domains outside the intended permitted namespace. Affected CPE products include all Red Hat Enterprise Linux distributions (RHEL 6-10), containerized environments (OpenShift Container Platform 4, Hardened Images), indicating the vulnerability exists in the base GnuTLS library package distributed across these platforms.

Know when Red Hat Enterprise Linux 10 gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (redhat) PRIMARY 7.4 HIGH
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
SUSE HIGH
Red Hat 7.4 MEDIUM

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None

DescriptionCVE.org

A flaw was found in gnutls. This vulnerability occurs because permitted name constraints were incorrectly ignored when previous Certificate Authorities (CAs) only had excluded name constraints. A remote attacker could exploit this to bypass critical name constraint checks during certificate validation. This bypass could lead to the acceptance of invalid certificates, potentially enabling spoofing or man-in-the-middle attacks against affected systems.

Executive ViewAI

Why It Matters

GnuTLS certificate validation bypass (CVE-2026-42011) allows attackers to present fraudulent certificates that pass validation checks, creating man-in-the-middle attack vectors across TLS-protected communications in Red Hat Enterprise Linux 6-10, OpenShift Container Platform 4, and Red Hat Hardened Images. This HIGH severity vulnerability directly threatens the integrity of encrypted traffic and authentication trust chains for any organization relying on affected Red Hat systems, requiring immediate inventory and mitigation planning.

Business Impact: High
Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: implement certificate pinning for critical services; deploy network-based TLS inspection to detect suspicious certificate chains; restrict outbound TLS connections to whitelisted CAs; increase logging and monitoring of certificate validation events; consider temporary isolation of non-critical affected systems pending patch availability. Escalate to Red Hat for patch timeline and consider RHEL version upgrade assessment.

Threat Intelligence Overview

EPSS Score
0.0%
Top 94% exploitable
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
No
Human Impact
High
Technical Impact
Total

Priority Score

37
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +37
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Authentication Bypass CRITICAL

Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.

Affected Products (CPE)CVE.org

cpe:2.3:a:red_hat:red_hat_enterprise_linux_10:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_6:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_7:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_8:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_9:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_hardened_images:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_openshift_container_platform_4:*:*:*:*:*:*:*:*

More in Red Hat Enterprise Linux 10

View all
CVE-2026-18663 MEDIUM
5.9 Aug 12

Heap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
CVE-2026-4631 CRITICAL POC
9.8 Apr 07

Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
CVE-2026-4480 CRITICAL POC
9.0 May 26

Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
CVE-2026-101258 HIGH POC
7.8 Oct 06

Ghostscript can execute arbitrary shell commands with the privileges of its process when it renders a crafted PostScript
CVE-2026-96889 HIGH POC
7.8 Sep 23

Use-after-free in librsvg during rendering of crafted SVG documents with nested XInclude directives and duplicate entity
CVE-2026-4775 HIGH POC
7.8 Mar 24

A signed integer overflow vulnerability exists in the libtiff library's putcontig8bitYCbCr44tile function that leads to

CVE-2026-114406 MEDIUM POC
6.8 Oct 21

The system CA trust store shipped in Red Hat's ca-certificates RPM packages includes eMudhra root authorities that signe
CVE-2026-18922 CRITICAL
9.8 Sep 07

Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
CVE-2026-14544 CRITICAL
9.8 Jul 03

Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter

CVE-2026-76578 CRITICAL
9.8 Sep 07

Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
CVE-2026-102560 CRITICAL
9.8 Sep 29

A heap buffer overflow exists in libsoup's WebSocket permessage-deflate compression path: when a very large outbound mes
CVE-2026-5121 HIGH
7.5 Mar 30

Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe

Same weakness CWE-295 – Improper Certificate Validation

View all
CVE-2026-85102 CRITICAL POC
9.8
CVE-2015-3152 MEDIUM POC
5.9
CVE-2017-2800 CRITICAL POC
9.8
CVE-2014-1266 HIGH POC
7.4
CVE-2022-47758 CRITICAL POC
9.8
CVE-2025-68121 CRITICAL POC
10.0
CVE-2025-29331 CRITICAL POC
9.8
CVE-2025-32878 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2015-3306 CRITICAL POC
10.0
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3

Vendor StatusVendor

SUSE

Severity: High
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Micro 5.3 Fixed
SUSE Linux Enterprise Micro 5.4 Fixed

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-42011 ADVISORY https://ubuntu.com/security/notices/USN-8284-1 ADVISORY https://vuldb.com/vuln/361870 REF https://access.redhat.com/errata/RHSA-2026:13274 REF https://access.redhat.com/errata/RHSA-2026:20611 REF https://access.redhat.com/errata/RHSA-2026:20612 REF https://access.redhat.com/errata/RHSA-2026:20613 REF https://access.redhat.com/errata/RHSA-2026:26319 REF https://access.redhat.com/errata/RHSA-2026:26409 REF https://access.redhat.com/errata/RHSA-2026:29197 REF https://access.redhat.com/errata/RHSA-2026:30004 REF https://access.redhat.com/errata/RHSA-2026:30849 REF https://access.redhat.com/errata/RHSA-2026:30850 REF https://access.redhat.com/errata/RHSA-2026:32962 REF https://access.redhat.com/errata/RHSA-2026:33125 REF https://access.redhat.com/errata/RHSA-2026:40762 REF https://access.redhat.com/errata/RHSA-2026:41921 REF https://access.redhat.com/errata/RHSA-2026:43575 REF https://access.redhat.com/errata/RHSA-2026:56853 REF https://access.redhat.com/errata/RHSA-2026:57483 REF https://access.redhat.com/errata/RHSA-2026:58981 REF https://access.redhat.com/errata/RHSA-2026:59831 REF https://access.redhat.com/errata/RHSA-2026:60019 REF https://access.redhat.com/errata/RHSA-2026:72502 REF https://access.redhat.com/errata/RHSA-2026:74674 REF https://access.redhat.com/errata/RHSA-2026:82304 REF https://access.redhat.com/errata/RHSA-2026:82322 REF https://access.redhat.com/errata/RHSA-2026:82347 REF https://access.redhat.com/errata/RHSA-2026:82354 REF https://access.redhat.com/errata/RHSA-2026:82372 REF https://access.redhat.com/errata/RHSA-2026:82857 REF https://access.redhat.com/errata/RHSA-2026:82888 REF https://access.redhat.com/errata/RHSA-2026:89197 REF https://access.redhat.com/errata/RHSA-2026:89232 REF https://access.redhat.com/errata/RHSA-2026:89333 REF https://access.redhat.com/security/cve/CVE-2026-42011 REF https://bugzilla.redhat.com/show_bug.cgi?id=2467437 REF https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-6

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy