Log in Start free

Vulnerability · Published Aug 24, 2026 · Assigned by redhat

CVE-2026-78323Jss: jss: jsstrustmanager does not verify nss trust flags on ca certificates

Medium 6.5

In plain English

A medium-severity improper certificate validation in Red Hat Certificate System 10 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.2%top 92.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A flaw was found in JSS (Java Security Services). The JSSTrustManager class does not verify NSS trust flags when validating CA certificates, allowing certificates present in the NSS database without TRUSTED_CA flags to be accepted as trust anchors for TLS connections. In non-default configurations where certificate revocation checking is disabled, this could allow a man-in-the-middle attacker to forge certificates accepted by PKI client connections.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12jssno fix listedDEBIAN-CVE-2026-78323
Debian:14jssno fix listedDEBIAN-CVE-2026-78323
Ubuntu:22.04:LTSjssno fix listedUBUNTU-CVE-2026-78323
Ubuntu:24.04:LTSjssno fix listedUBUNTU-CVE-2026-78323
Ubuntu:26.04:LTSjssno fix listedUBUNTU-CVE-2026-78323
Ubuntu:26.10jssno fix listedUBUNTU-CVE-2026-78323

Affected products (as reported)

VendorProductVersions
Red Hat Red Hat Certificate System 10 see references
Red Hat Red Hat Certificate System 11 see references
Red Hat Red Hat Enterprise Linux 10 see references
Red Hat Red Hat Enterprise Linux 6 see references
Red Hat Red Hat Enterprise Linux 7 see references
Red Hat Red Hat Enterprise Linux 8 see references
Red Hat Red Hat Enterprise Linux 9 see references

Weakness: CWE-295 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

References