CVE-2026-88648
Awaiting Analysis Awaiting Analysis - Queue

Incomplete X.509 Implementation in GnuTLS Allows Certificate Bypass

Publication date: 2026-10-08

Last updated on: 2026-10-08

Assigner: MITRE

Description
Incomplete X.509 implementation in GnuTLS v3.8.13 allows attackers controlling a subordinate Certificate Authority to bypass cross-domain PKI restrictions and issue unauthorized certificates.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-08
Last Modified
2026-10-08
Generated
2026-10-09
AI Q&A
2026-10-08
EPSS Evaluated
N/A
NVD
CVE-2026-88648
EUVD
EUVD-2026-95205

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
n/a n/a n/a

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in GnuTLS v3.8.13 due to incomplete X.509 implementation. Attackers who control a subordinate Certificate Authority can bypass PKI restrictions and issue unauthorized certificates across domains.

Detection Guidance

To detect this vulnerability, check the GnuTLS version on your system using 'gnutls-cli --version' or 'dpkg -l | grep gnutls'. If version 3.8.13 is installed, the system is vulnerable. Review certificate chains for improperly issued certificates by examining logs or using OpenSSL commands like 'openssl verify -CAfile chain.pem cert.pem'.

Impact Analysis

If exploited, this flaw could allow attackers to impersonate legitimate services or users, leading to data breaches, unauthorized access, or man-in-the-middle attacks.

Compliance Impact

This vulnerability could violate compliance requirements by enabling unauthorized access to sensitive data, potentially leading to legal penalties under GDPR or HIPAA.

Mitigation Strategies

Immediately upgrade GnuTLS to a patched version if available. Disable subordinate CAs with weak validation policies. Monitor certificate issuance logs for unauthorized certificates. Temporarily enforce stricter PKI restrictions until patches are applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-88648. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart