python-cryptography CVE-2026-69248

Exploitation requires three concurrent conditions: (1) the verifying application must use python-cryptography's native X.509 verification API (cryptography.x509.verification.PolicyBuilder and Store), not OpenSSL-backed verification; (2) the certificate chain must include an intermediate CA whose BasicConstraints marks it as a CA and whose NameConstraints extension specifies a permittedSubtrees list containing a specific DNS name (e.g., foo.example.com); and (3) the attacker must present or obtain a leaf certificate issued under that constrained sub-CA bearing a wildcard DNS SAN broader than the constraint (e.g., *.example.com). Exploitation is entirely blocked for applications that verify certificates through OpenSSL's engine. No user interaction is required once the crafted chain is presented. The principal limiting factor is that the attacker must control or obtain a certificate issued by the constrained intermediate CA, which typically implies prior compromise or authorized access to that CA's issuance process.

The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N) scores 6.9 with high integrity impact, reflecting the ability to present certificates as valid for domains outside the constrained sub-CA's permitted scope. AT:P (Attack Requirements: Present) is the critical moderating factor - exploitation requires the verifying application to use python-cryptography's PolicyBuilder/Store API and the certificate chain must include an intermediate CA with a permittedSubtrees Name Constraints extension. This is a non-default PKI configuration found primarily in enterprise, government, and regulated-industry PKI hierarchies. The E:P modifier confirms a public PoC exists, lowering exploitation bar for capable attackers. No EPSS score was provided in the input, so exploitation probability cannot be quantified. This is NOT in the CISA KEV catalog. Real-world impact is significant where Name Constraints enforcement is a security control, but the attack requires controlling a certificate issued under the constrained sub-CA - a meaningful limiting factor. For most deployments that verify certificates via OpenSSL's own engine rather than pyca's pure-Python/Rust verifier, this issue does not apply.

An attacker who has been issued a certificate by a constrained intermediate CA (permitted subtree: foo.example.com) requests or forges a leaf certificate with a wildcard SAN of *.example.com instead of a specific name. When this certificate is presented to a service or client using python-cryptography's PolicyBuilder/Store verifier, the verifier incorrectly accepts the chain and treats the certificate as authoritative for bar.example.com - a domain outside the sub-CA's permitted scope. The GHSA advisory includes a complete, runnable PoC demonstrating this escape using pyca's public API.