Improper Certificate Hostname Validation in C-Kermit by OpenKermit
CVE-2026-129118

7.6HIGH

Key Information:

Vendor

Openkermit

Status
C-kermit
Vendor
CVE Published:
13 November 2026

What is CVE-2026-129118?

C-Kermit versions prior to 11.1.515 are susceptible to an improper certificate hostname validation vulnerability. This issue arises from inadequate handling of wildcard characters during hostname verification, allowing attackers with a valid certificate to falsely represent themselves as legitimate hosts. Exploitation of this vulnerability enables unauthorized interception of sensitive data and credentials across various communication protocols, including Telnet, FTP, and HTTP TLS. Users are advised to update to the latest version to mitigate this risk.

Affected Version(s)

C-Kermit 8.0.200 < 11.1.515

References

https://github.com/OpenKermit/ckermit/security/advisories...
vendor-advisory
https://github.com/OpenKermit/ckermit/commit/8c60a2bd70f5...
patch
https://github.com/OpenKermit/ckermit/releases/tag/v11.1.515
release-notes

CVSS V4

Score:
7.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

John Goerzen
John Goerzen
.