Log in Start free

Vulnerability · Published Sep 16, 2026 · Assigned by redhat

CVE-2026-42784Sequoia-openpgp: sequoia-openpgp: cryptographic integrity compromise via key flag confusion

High 7.4

In plain English

A high-severity security flaw in Confidential Compute Attestation from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.4High
Exploit odds (30 days)0.3%top 75.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A flaw was found in sequoia-openpgp. The library incorrectly infers key flags for older certificates when a key flags subpacket is missing, leading to a discrepancy in how key capabilities are viewed. This key flag confusion allows an attacker to bypass the back-signature check. Consequently, an attacker can illegitimately bind an arbitrary subkey to their own certificate and forge signatures, completely compromising cryptographic integrity.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:10rpm-sequoia1.10.2.1-1.el10_2ALSA-2026:76734
AlmaLinux:9rpm-sequoia1.10.2.1-1.el9_8ALSA-2026:76733
AlmaLinux:10rpm-sequoia-devel1.10.2.1-1.el10_2ALSA-2026:76734
AlmaLinux:9rpm-sequoia-devel1.10.2.1-1.el9_8ALSA-2026:76733
AlmaLinux:10sequoia-sq1.4.0.1-2.el10_2ALSA-2026:76737
AlmaLinux:10sequoia-sqv1.3.0.2-1.el10_2ALSA-2026:76735
Debian:12rust-sequoia-openpgpno fix listedDEBIAN-CVE-2026-42784
Debian:13rust-sequoia-openpgpno fix listedDEBIAN-CVE-2026-42784
Debian:14rust-sequoia-openpgp2.2.0-2DEBIAN-CVE-2026-42784
Rocky Linux:10rust-rpm-sequoia0:1.10.2.1-1.el10_2RLSA-2026:76734
Rocky Linux:9rust-rpm-sequoia0:1.10.2.1-1.el9_8RLSA-2026:76733
Rocky Linux:10rust-sequoia-sq0:1.4.0.1-2.el10_2RLSA-2026:76737
Rocky Linux:10rust-sequoia-sqv0:1.3.0.2-1.el10_2RLSA-2026:76735
Ubuntu:22.04:LTSrust-sequoia-openpgpno fix listedUBUNTU-CVE-2026-42784
Ubuntu:24.04:LTSrust-sequoia-openpgpno fix listedUBUNTU-CVE-2026-42784
Ubuntu:25.10rust-sequoia-openpgpno fix listedUBUNTU-CVE-2026-42784
Ubuntu:26.04:LTSrust-sequoia-openpgpno fix listedUBUNTU-CVE-2026-42784
Ubuntu:26.10rust-sequoia-openpgpno fix listedUBUNTU-CVE-2026-42784

Affected products (as reported)

VendorProductVersions
Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9 see references
Red Hat Red Hat Enterprise Linux 10 see references
Red Hat Red Hat Enterprise Linux 10 see references
Red Hat Red Hat Enterprise Linux 10 see references
Red Hat Red Hat Enterprise Linux 9 see references
Red Hat Red Hat Cost Management On-Premise 1 see references
Red Hat Red Hat Hardened Images see references
Red Hat Red Hat Hardened Images see references
Red Hat Confidential Compute Attestation see references
Red Hat Confidential Compute Attestation see references
Red Hat Confidential Compute Attestation see references
Red Hat Confidential Compute Attestation see references
Red Hat Confidential Compute Attestation see references
Red Hat Red Hat Ansible Automation Platform 2 see references
Red Hat Red Hat Ansible Automation Platform 2 see references
Red Hat Red Hat Enterprise Linux 10 see references
Red Hat Red Hat Enterprise Linux 10 see references
Red Hat Red Hat Enterprise Linux 10 see references
Red Hat Red Hat Enterprise Linux 9 see references
Red Hat Red Hat OpenShift Container Platform 4 see references
Red Hat Red Hat Satellite 6 see references
Red Hat Red Hat Satellite 6 see references
Red Hat Red Hat Trusted Profile Analyzer see references
Red Hat Red Hat Trusted Profile Analyzer see references

Weakness: CWE-347 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N

References