Bouncy Castle CVE-2026-71890

Exploitation requires that the target application use Bouncy Castle for Java's MLS (RFC 9420) implementation and accept external commits via the public Group.externalJoin / Group.handle API on a version before 1.86. The attacker must possess the group's public GroupInfo, which external joiners are legitimately provided, so no group membership or credential is needed; the missing credential check that would have tied the Remove to the joiner existed only in the gRPC interop harness (MLSClientImpl.externalJoinImpl) and protected no other API caller. Limiting factors: deployments not using the MLS module or not permitting external commits are unaffected, and the attacker still needs access to the public GroupInfo distribution channel. Impact is limited to membership integrity (eviction and slot takeover); it does not directly expose message confidentiality.

The vendor CVSS 4.0 base score is 8.7 (High) with vector AV:N/AC:L/AT:N/PR:N/UI:N, meaning the flaw is reachable over the network, needs no special attack requirements, no privileges, and no user interaction - a trivially reachable precondition set. Impact is scoped to integrity only (VC:N/VI:H/VA:N, no subsequent-system impact SC:N/SI:N/SA:N), consistent with the described effect: an attacker cannot read group messages but can tamper with group membership by evicting arbitrary members and seizing their ratchet-tree slot. The CWE is CWE-863 (Incorrect Authorization); note the input tag 'Authentication Bypass' is imprecise - the attacker is a protocol-legitimate external joiner and the defect is a missing authorization/credential check, not an authentication bypass. Signals are incomplete: no EPSS score, no SSVC decision data, no KEV listing, and no POC were provided, so exploitation likelihood cannot be quantified from the input - exploitation status is therefore 'no public exploit identified at time of analysis.' The 'PR:N' rating is correct in the MLS trust model because possessing the public GroupInfo (deliberately handed to external joiners) is the only prerequisite, but real-world risk is gated hard by whether a given deployment actually uses Bouncy Castle's MLS (RFC 9420) module and accepts external commits - a niche feature. Net: a genuinely serious authorization flaw where exploitable, but likely a low-population issue rather than a mass-exploitation priority; verify EPSS/KEV independently as neither was supplied.

An attacker obtains the group's public GroupInfo - exactly what an external joiner is meant to be given - and crafts an external commit carrying a single Remove proposal naming any existing member's LeafIndex. Because Group.validateExternalCachedProposals bounded the removed leaf index but never tied the removed leaf's credential to the joiner, every member accepts the commit, evicting the targeted member and letting the attacker take over their slot in the ratchet tree. No public exploit identified at time of analysis.