Log in Start free

Vulnerability · Published Oct 26, 2026 · Assigned by EEF

CVE-2026-115693Custom cacerts or cacertfile do not restrict trust to the pinned CA in hackney

Critical 9.1

In plain English

A critical-severity improper certificate validation in hackney from benoitc. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities).

Severity (CVSS 4.0)9.1Critical
Exploit odds (30 days)0.3%top 81.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Improper Certificate Validation vulnerability in hackney_ssl in benoitc hackney allows an on-path attacker to impersonate a server pinned to a private certificate authority via a certificate chain that ends in a publicly trusted root. hackney adds {partial_chain, fun hackney_ssl:partial_chain/1} to every verify_peer configuration. The callback returns any certificate in the peer chain whose public key matches a root in the bundled certifi store as the trust anchor, and OTP honours that callback over the configured cacerts. hackney_ssl:merge_ssl_opts/3 kept the callback when the caller replaced the trust store with cacerts or cacertfile in ssl_options, so a connection pinned to a private CA still accepted any chain that carried a publicly trusted root. The hostname check still applies, so the attacker needs a publicly trusted certificate for the pinned hostname. This issue affects hackney: from 1.24.0 before 4.9.0.

Affected products (as reported)

VendorProductVersions
benoitc hackney 1.24.0 – before 4.9.0
benoitc hackney d8a9afcf5c3849904274e2eba1df56c63d1a1a0c – before 915eb5737e9c489d8fc22eec8cdae30e9b027be4

Weakness: CWE-295 · Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

References