CVE-2026-67693

Awaiting Analysis Awaiting Analysis - Queue

BaseFortify

Publication date: 2026-10-08

Last updated on: 2026-11-04

Assigner: MITRE

Description

GnuTLS v3.8.13 does not reject end-entity X.509 certificates that contain a contradictory combination of Key Usage (KU) and Extended Key Usage (EKU). NOTE: the Supplier does not consider this an actionable security vulnerability because of its "threat model doesn't consider attacks only possible by modifying anything within the trust boundary (private keys, trusted certificate authorities and their issued certificates including intermediate CAs, etc.)" policy.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-08

Last Modified

2026-11-04

Generated

2026-11-08

AI Q&A

2026-10-08

EPSS Evaluated

2026-11-07

NVD

CVE-2026-67693

EUVD

EUVD-2026-95206

Affected Vendors & Products

Vendor	Product	Version / Range
n/a	n/a	n/a

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-367	The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.

Attack-Flow Graph

Executive Summary

This vulnerability in GnuTLS v3.8.13 allows an attacker to potentially access sensitive information. The issue occurs when the library fails to properly reject X.509 certificates that have conflicting Key Usage (KU) and Extended Key Usage (EKU) extensions. This contradiction could be exploited to bypass intended security restrictions.

Detection Guidance

To detect this vulnerability, inspect GnuTLS version 3.8.13 systems for improper certificate validation. Check certificates with critical Key Usage extensions where all bits are cleared and Extended Key Usage includes serverAuth. Use OpenSSL or GnuTLS tools to examine certificate extensions and validate Key Usage enforcement.

Impact Analysis

If exploited, this vulnerability could allow unauthorized access to sensitive data protected by the affected GnuTLS implementation. Attackers might intercept or decrypt communications, impersonate servers, or gain access to protected resources by presenting maliciously crafted certificates.

Compliance Impact

This vulnerability could lead to violations of data protection regulations like GDPR or HIPAA by enabling unauthorized access to personal or health data. Organizations using affected GnuTLS versions may fail compliance audits if they cannot demonstrate proper certificate validation.

Mitigation Strategies

Upgrade GnuTLS to a patched version beyond 3.8.13. Temporarily disable certificate validation for affected systems if immediate upgrade is not possible. Review and revoke any certificates with contradictory Key Usage and Extended Key Usage extensions.

Hi! I’m here to help you understand CVE-2026-67693. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...