CVE-2026-103503
Received Received - Intake

Improper Certificate Validation in Hex

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: EEF

Description
Improper Certificate Validation vulnerability in hexpm hex allows an attacker who can intercept HTTPS connections, and holds a certificate for a Hex host issued by a CA in Hex's bundled CA store, to impersonate that host to users who set cacerts_path to a CA store that leaves that CA out. cacerts_path (HEX_CACERTS_PATH) is documented as the path to the CA certificate store, used instead of the CA bundle that ships with Hex. Hex.HTTP.SSL.ssl_opts/1 passes the configured store as the cacerts option, but builds the partial_chain callback from the bundled store whether cacerts_path is set or not. Hex.HTTP.SSL.partial_chain/2 accepts a server chain when any certificate in it has the same public key as a bundled CA certificate, so a chain that leads to a bundled CA passes verification although the configured store doesn't contain that CA. Hostname verification still applies. This issue affects hex: from 0.20.2 before 2.5.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-103503
EUVD
EUVD-2026-97497

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
hexpm hex 0.20.2
hexpm hex c9b26a46928bfcd546773571e09c1d05f4cd9fb7

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-295 The product does not validate, or incorrectly validates, a certificate.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-103503 is an improper certificate validation flaw in Hex, an Erlang/Elixir package manager. It affects versions between 0.20.2 and 2.5.1. When users set a custom CA certificate store via `cacerts_path`, Hex still trusted its bundled CA certificates for partial chain validation. This allowed attackers with a certificate issued by a bundled CA to impersonate Hex servers, potentially stealing API keys or tokens.

Detection Guidance

Check Hex version with `hex --version` to see if it is between 0.20.2 and 2.5.1. Inspect environment variables for `cacerts_path` or `HEX_CACERTS_PATH` set in shell or configuration files. Monitor network traffic for unexpected certificate chains during Hex operations.

Impact Analysis

If you used Hex versions 0.20.2 to 2.5.1 with a custom `cacerts_path`, an attacker could intercept HTTPS traffic and impersonate Hex servers. This could lead to theft of API keys, OAuth tokens, or repository keys. Package integrity was not compromised as signatures and checksums remained secure.

Compliance Impact

This vulnerability could potentially violate compliance with GDPR and HIPAA by allowing unauthorized interception of sensitive data. Attackers could impersonate Hex hosts to steal API keys, OAuth tokens, or repository keys, which may include protected health information (PHI) or personal data. The improper certificate validation undermines secure data transmission required by these regulations.

Mitigation Strategies

Upgrade Hex to version 2.5.2 or later using `mix local.hex --force`. If using a custom CA store, ensure it only contains trusted certificates and remove any bundled CA references. Verify SSL settings by testing with `mix hex.info` or similar commands.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-103503. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart