Key Flag Confusion in Sequoia-OpenPGP Library Affecting Red Hat
CVE-2026-42784
7.4HIGH
Key Information:
- Vendor
Red Hat
- Status
- Vendor
- CVE Published:
- 16 September 2026
What is CVE-2026-42784?
A critical flaw exists in the Sequoia-OpenPGP library, where the inference of key flags for older certificates is inaccurately handled when a key flags subpacket is absent. This discrepancy can lead to significant security issues, as it permits an attacker to circumvent the back-signature verification process. As a result, malicious actors can falsely bind arbitrary subkeys to their own certificates, allowing them to forge signatures and severely undermine the cryptographic integrity that is essential for secure communications.
Affected Version(s)
Red Hat Ansible Automation Platform 2.6 for RHEL 9 0:0.1.34-1.el9ap
Red Hat Cost Management On-Premise 1 1791460851
Red Hat Enterprise Linux 10 0:1.10.2.1-1.el10_2