Improper Certificate Validation in python-cryptography - CVE-2026-69248
Published: August 1, 2026
Vulnerability identifier: #VU140697
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-69248
CWE-ID: CWE-295
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to spoof certificate identity validation.
The vulnerability exists due to improper certificate validation in the certificate verifier when processing certificate chains with wildcard DNS subject alternative names under permitted subtrees constraints. A remote attacker can present a specially crafted certificate chain to spoof certificate identity validation.
The issue occurs when an intermediate constrained CA permits a specific DNS name such as foo.example.com, but a leaf certificate uses a broader wildcard DNS SAN such as *.example.com.
Affected software
python-cryptography
Maximo Application Suite - Edge Data Collector
QRadar App SDK
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Ubuntu
IBM Security SOAR
python-cryptography (Ubuntu package)
python3.14-cryptography (Red Hat package)
Maximo Application Suite - Edge Data Collector
QRadar App SDK
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Ubuntu
IBM Security SOAR
python-cryptography (Ubuntu package)
python3.14-cryptography (Red Hat package)
How to mitigate CVE-2026-69248
Install security update from vendor's website.
python-cryptography - update to 49.0.0
Maximo Application Suite - Edge Data Collector - addressed in versions 9.0.25, 9.1.15, 9.2.4
IBM Security SOAR - update to 51.0.11.0
python-cryptography (Ubuntu package) - addressed in versions 2.1.4-1ubuntu1.4+esm6, 46.0.5-1ubuntu2.2
QRadar App SDK - update to 2.2.7
python3.14-cryptography (Red Hat package) - addressed in versions 45.0.4-4.el9_8.6, 45.0.4-4.el10_2.5
Maximo Application Suite - Edge Data Collector - addressed in versions 9.0.25, 9.1.15, 9.2.4
IBM Security SOAR - update to 51.0.11.0
python-cryptography (Ubuntu package) - addressed in versions 2.1.4-1ubuntu1.4+esm6, 46.0.5-1ubuntu2.2
QRadar App SDK - update to 2.2.7
python3.14-cryptography (Red Hat package) - addressed in versions 45.0.4-4.el9_8.6, 45.0.4-4.el10_2.5
External References
Related Security Bulletins
- Multiple vulnerabilities in python-cryptography
- Multiple vulnerabilities in IBM Security SOAR
- Red Hat Enterprise Linux 9 update for python3.14-cryptography
- Red Hat Enterprise Linux 10 update for python3.14-cryptography
- Multiple vulnerabilities in IBM QRadar App SDK
- Multiple vulnerabilities in IBM Edge Data Collector
- Ubuntu update for python-cryptography