Improper Certificate Validation Vulnerability in Hackney from Benoitc

CVE-2026-115693

What is CVE-2026-115693?

A vulnerability in the hackney_ssl component of Benoitc Hackney allows an on-path attacker to impersonate a server that relies on private certificate authorities through a misleading certificate chain that concludes with a publicly trusted root. This occurs because hackney's verification processes accept any certificate within the peer chain whose public key corresponds to a root in the bundled certifi store. Consequently, an attacker can exploit the callback mechanism in OTP's ssl_options if the system is configured with a custom trust store. Although the hostname verification remains intact, the attacker must still possess a valid publicly trusted certificate for the targeted hostname.

References