CVE-2026-96770
Received Received - Intake

TLS Client Certificate Spoofing in s2s-proxy

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: Temporal Technologies Inc.

Description
All published s2s-proxy versions through 0.2.2 are affected. In versions 0.1.16 through 0.2.2, TLS server listeners use Go's RequireAnyClientCert mode when skipCAVerification is false. This mode checks that the client holds the certificate's private key but does not verify the certificate against the configured CA. An attacker can therefore use a self-signed certificate and key to establish a TLS and yamux connection, then invoke RPCs allowed by the proxy's configuration and Temporal credentials. No certificate or private key trusted by the deployment, and no Temporal credential, is required.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-24
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-96770
EUVD
EUVD-2026-85567

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
temporal s2s-proxy From 0.1.16 (inc) to 0.2.2 (inc)
temporal s2s-proxy 0.2.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-296 The product does not follow, or incorrectly follows, the chain of trust for a certificate back to a trusted root certificate, resulting in incorrect trust of any resource that is associated with that certificate.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects all published s2s-proxy versions through 0.2.2. It involves TLS server listeners using Go's RequireAnyClientCert mode when skipCAVerification is false. This mode only checks if the client has a certificate's private key but does not verify the certificate against the configured CA. Attackers can exploit this by using a self-signed certificate and key to establish a TLS and yamux connection, then invoke allowed RPCs without needing trusted certificates or Temporal credentials.

Detection Guidance

Check if your s2s-proxy version is 0.1.16 through 0.2.2. Inspect TLS listener configurations for use of RequireAnyClientCert mode with skipCAVerification set to false. Review logs for unauthorized TLS connections or RPC invocations.

Impact Analysis

An attacker could gain unauthorized access to the system by bypassing certificate validation. This allows them to establish connections and invoke RPCs permitted by the proxy's configuration and Temporal credentials. The impact includes potential data breaches, unauthorized actions, and compromised system integrity.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements for data protection and privacy. GDPR requires protection of personal data, while HIPAA mandates safeguards for protected health information. Exploitation of this flaw may result in non-compliance, legal penalties, and reputational damage due to data exposure.

Mitigation Strategies

Upgrade s2s-proxy to a version beyond 0.2.2 where RequireAndVerifyClientCert is enforced. Set skipCAVerification to true only if client certificate verification is not required. Ensure remoteCAPath points to a valid CA certificate and enforce strict TLS validation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-96770. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart