Improper Certificate Validation in python-cryptography - CVE-2026-69248
Published: August 1, 2026
Vulnerability identifier: #VU140697
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-69248
CWE-ID: CWE-295
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to spoof certificate identity validation.
The vulnerability exists due to improper certificate validation in the certificate verifier when processing certificate chains with wildcard DNS subject alternative names under permitted subtrees constraints. A remote attacker can present a specially crafted certificate chain to spoof certificate identity validation.
The issue occurs when an intermediate constrained CA permits a specific DNS name such as foo.example.com, but a leaf certificate uses a broader wildcard DNS SAN such as *.example.com.
Affected software
python-cryptography
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
IBM Security SOAR
python3.14-cryptography (Red Hat package)
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
IBM Security SOAR
python3.14-cryptography (Red Hat package)
How to mitigate CVE-2026-69248
Install security update from vendor's website.
python-cryptography - update to 49.0.0
IBM Security SOAR - update to 51.0.11.0
python3.14-cryptography (Red Hat package) - addressed in versions 45.0.4-4.el9_8.6, 45.0.4-4.el10_2.5
IBM Security SOAR - update to 51.0.11.0
python3.14-cryptography (Red Hat package) - addressed in versions 45.0.4-4.el9_8.6, 45.0.4-4.el10_2.5