VDB

CVE-2026-42784

CVE-2026-42784 PUBLISHED CVSS 7.4 HIGH

Reported by redhat · Published September 16, 2026

A flaw was found in sequoia-openpgp. The library incorrectly infers key flags for older certificates when a key flags subpacket is missing, leading to a discrepancy in how key capabilities are viewed. This key flag confusion allows an attacker to bypass the back-signature check. Consequently, an attacker can illegitimately bind an arbitrary subkey to their own certificate and forge signatures, completely compromising cryptographic integrity.

Risk Scores

CVSS 3.1
7.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N

Affected Products

VendorProductVersions
Red HatRed Hat Ansible Automation Platform 2.6 for RHEL 90:0.1.34-1.el9ap
Red HatRed Hat Enterprise Linux 100:1.10.2.1-1.el10_2
Red HatRed Hat Enterprise Linux 100:1.3.0.2-1.el10_2
Red HatRed Hat Enterprise Linux 100:1.4.0.1-2.el10_2
Red HatRed Hat Enterprise Linux 90:1.10.2.1-1.el9_8
Red HatRed Hat Cost Management On-Premise 11791460851
Red HatRed Hat Hardened Images0.3.2-4.hum1
Red HatConfidential Compute Attestation
Red HatConfidential Compute Attestation
Red HatConfidential Compute Attestation
Red HatConfidential Compute Attestation
Red HatConfidential Compute Attestation
Red HatRed Hat Ansible Automation Platform 2
Red HatRed Hat Ansible Automation Platform 2
Red HatRed Hat Enterprise Linux 10
Red HatRed Hat Enterprise Linux 10
Red HatRed Hat Enterprise Linux 10
Red HatRed Hat Enterprise Linux 9
Red HatRed Hat Hardened Images
Red HatRed Hat OpenShift Container Platform 4

…and 30 more

Timeline

  • Sep 16, 2026 Coalition ESS Score
  • Sep 16, 2026 CVE Published
  • Sep 17, 2026 EPSS Score
  • Sep 22, 2026 EPSS Score
  • Sep 24, 2026 EPSS Score
  • Sep 26, 2026 EPSS Score
  • Oct 6, 2026 EPSS Score
  • Oct 6, 2026 Distribution Patch
  • Oct 6, 2026 Security Advisory
  • Oct 7, 2026 EPSS Score
  • Oct 8, 2026 EPSS Score
  • Oct 8, 2026 Distribution Patch

References

Open in Interactive Console →
$ Console Community · 50/day Open console ›