Improper Certificate Validation in uv - CVE-2026-119327
Published: November 9, 2026
Vulnerability identifier: #VU163001
CSH Severity: Medium
CVSS v4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-119327
CWE-ID: CWE-295
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated network attacker to impersonate HTTPS websites contacted by uv and compromise connection confidentiality and integrity.
The vulnerability exists due to uv's default bundled CA certificates trusting the emSign ECC Root CA - G3 root, whose intermediate CA keys are compromised. An unauthenticated network attacker can use a compromised intermediate key to issue trusted website certificates and intercept or alter HTTPS traffic when positioned between uv and a server.
Affected software
uv
How to mitigate CVE-2026-119327
Install security update from vendor's website.
uv - update to 0.13.4