CVE-2026-115693
Awaiting Analysis Awaiting Analysis - Queue

Improper Certificate Validation in hackney

Publication date: 2026-10-26

Last updated on: 2026-10-26

Assigner: EEF

Description
Improper Certificate Validation vulnerability in hackney_ssl in benoitc hackney allows an on-path attacker to impersonate a server pinned to a private certificate authority via a certificate chain that ends in a publicly trusted root. hackney adds {partial_chain, fun hackney_ssl:partial_chain/1} to every verify_peer configuration. The callback returns any certificate in the peer chain whose public key matches a root in the bundled certifi store as the trust anchor, and OTP honours that callback over the configured cacerts. hackney_ssl:merge_ssl_opts/3 kept the callback when the caller replaced the trust store with cacerts or cacertfile in ssl_options, so a connection pinned to a private CA still accepted any chain that carried a publicly trusted root. The hostname check still applies, so the attacker needs a publicly trusted certificate for the pinned hostname. This issue affects hackney: from 1.24.0 before 4.9.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-26
Last Modified
2026-10-26
Generated
2026-10-26
AI Q&A
2026-10-26
EPSS Evaluated
N/A
NVD
CVE-2026-115693
EUVD
EUVD-2026-109836

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
benoitc hackney 1.24.0
benoitc hackney d8a9afcf5c3849904274e2eba1df56c63d1a1a0c

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-295 The product does not validate, or incorrectly validates, a certificate.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves improper certificate validation in the hackney_ssl library. An attacker on the network path can impersonate a server by presenting a certificate chain that ends with a publicly trusted root, even if the server is pinned to a private certificate authority. The library's callback function incorrectly prioritizes the callback over the configured trust store, allowing unauthorized certificates to be accepted.

Impact Analysis

An attacker could intercept and decrypt communications to a server pinned to a private CA by presenting a fraudulent certificate. This could lead to data breaches, unauthorized access, or man-in-the-middle attacks. The impact is higher if the server handles sensitive data.

Compliance Impact

This vulnerability could violate compliance requirements that mandate secure communication and certificate validation, such as GDPR's data protection principles or HIPAA's security rules for protected health information. Failure to validate certificates properly may result in non-compliance and potential legal consequences.

Mitigation Strategies

Upgrade hackney to version 4.9.0 or later to address the improper certificate validation issue in hackney_ssl.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-115693. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart