Certificate Validation Flaw in OpenSSL Affects Root CA Key Update Process

CVE-2026-42769

What is CVE-2026-42769?

A flaw in the callback mechanism used to validate certificates during the root Certification Authority (CA) key update process in OpenSSL has been identified. This flaw can potentially enable an attacker with valid Registration Authority (RA) credentials to replace a root CA certificate with a malicious certificate. Misconfigurations in the certificate verification code could render the process ineffective, as the wrong certificates may be accepted, jeopardizing the trust framework of affected Certificate Management Protocol (CMP) clients. This vulnerability highlights the importance of accurate certificate chain construction for secure communications.

References