CVE-2026-69248

Received Received - Intake

Wildcard DNS SAN Bypass in python-cryptography

Publication date: 2026-08-03

Last updated on: 2026-08-03

Assigner: GitHub, Inc.

Description

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to 49.0.0, if an intermediate constrained CA permits the DNS name foo.example.com, and the leaf certificate has a wildcard in its DNS SAN of *.example.com, python-cryptography's verifier accepts which allows escaping outside of the permitted names. The core issue is in DNSConstraint::matches, where a wildcard pattern was treated as matching a more-specific permitted constraint even though *.example.com can expand to sibling names such as bar.example.com outside foo.example.com. This allows acceptance of an invalid certificate chain. This issue is fixed in 49.0.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-03

Last Modified

2026-08-03

Generated

2026-08-04

AI Q&A

2026-08-04

EPSS Evaluated

N/A

NVD

CVE-2026-69248

Affected Vendors & Products

Vendor	Product	Version / Range
python	cryptography	49.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-295	The product does not validate, or incorrectly validates, a certificate.

Attack-Flow Graph

Executive Summary

This vulnerability affects the python-cryptography library before version 49.0.0. It involves improper validation of wildcard DNS names in certificates. Specifically, if an intermediate certificate authority (CA) allows a DNS name like foo.example.com, but a leaf certificate has a wildcard DNS SAN of *.example.com, the library incorrectly accepts it. This allows certificates to cover unintended domains like bar.example.com, bypassing intended constraints.

Detection Guidance

This vulnerability affects systems using python-cryptography versions prior to 49.0.0. To detect it, check the installed version with: pip show cryptography. If the version is below 49.0.0, the system is vulnerable. Additionally, inspect certificates for wildcard DNS SANs like *.example.com that could match constrained intermediate CAs.

Impact Analysis

This vulnerability could allow attackers to present invalid certificate chains that appear valid. If exploited, it may enable man-in-the-middle attacks, where attackers intercept or alter communications between systems. Systems using affected versions of python-cryptography might trust unauthorized certificates, risking data exposure or unauthorized access.

Compliance Impact

This vulnerability allows acceptance of invalid certificate chains, which could lead to man-in-the-middle attacks. This may compromise data integrity and confidentiality, potentially violating GDPR's data protection requirements and HIPAA's security standards for protected health information.

Mitigation Strategies

Upgrade the python-cryptography package to version 49.0.0 or later to address the certificate validation issue.

Hi! I’m here to help you understand CVE-2026-69248. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70