CVE-2026-69248

Awaiting Analysis Awaiting Analysis - Queue

Wildcard DNS SAN Bypass in python-cryptography

Publication date: 2026-08-03

Last updated on: 2026-09-10

Assigner: GitHub, Inc.

Description

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In versions 45.0.0 through 48.0.0, if an intermediate constrained CA permits the DNS name foo.example.com, and the leaf certificate has a wildcard in its DNS SAN of *.example.com, python-cryptography's verifier accepts which allows escaping outside of the permitted names. The core issue is in DNSConstraint::matches, where a wildcard pattern was treated as matching a more-specific permitted constraint even though *.example.com can expand to sibling names such as bar.example.com outside foo.example.com. This allows acceptance of an invalid certificate chain. This issue is fixed in 49.0.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-03

Last Modified

2026-09-10

Generated

2026-09-13

AI Q&A

2026-08-04

EPSS Evaluated

2026-09-12

NVD

CVE-2026-69248

Affected Vendors & Products

Vendor	Product	Version / Range
python	cryptography	49.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-295	The product does not validate, or incorrectly validates, a certificate.

Attack-Flow Graph

Executive Summary

This vulnerability affects the python-cryptography library before version 49.0.0. It involves improper validation of wildcard DNS names in certificates. Specifically, if an intermediate certificate authority (CA) allows a DNS name like foo.example.com, but a leaf certificate has a wildcard DNS SAN of *.example.com, the library incorrectly accepts it. This allows certificates to cover unintended domains like bar.example.com, bypassing intended constraints.

Detection Guidance

This vulnerability affects systems using python-cryptography versions prior to 49.0.0. To detect it, check the installed version with: pip show cryptography. If the version is below 49.0.0, the system is vulnerable. Additionally, inspect certificates for wildcard DNS SANs like *.example.com that could match constrained intermediate CAs.

Impact Analysis

This vulnerability could allow attackers to present invalid certificate chains that appear valid. If exploited, it may enable man-in-the-middle attacks, where attackers intercept or alter communications between systems. Systems using affected versions of python-cryptography might trust unauthorized certificates, risking data exposure or unauthorized access.

Compliance Impact

This vulnerability allows acceptance of invalid certificate chains, which could lead to man-in-the-middle attacks. This may compromise data integrity and confidentiality, potentially violating GDPR's data protection requirements and HIPAA's security standards for protected health information.

Mitigation Strategies

Upgrade the python-cryptography package to version 49.0.0 or later to address the certificate validation issue.

Hi! I’m here to help you understand CVE-2026-69248. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70