Vulnerabilities

Vulnerability · CVE-2026-115693

Custom cacerts or cacertfile do not restrict trust to the pinned CA in hackney

Published Oct 26, 2026 · catalog updated Oct 26, 2026 · Custom cacerts or cacertfile

Last checked Nov 5, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-115693. EPSS is 0.27%. Act only if a listed version of Custom cacerts or cacertfile is installed.

Severity

Unknown—

Known exploitation

Not in CISA/VulnCheck KEV

EPSS

0.27%

Remediation

Advisory link

Affected products

Hex hackney

## Summary Improper Certificate Validation vulnerability in in benoitc hackney allows an on-path attacker to impersonate a server pinned to a private certificate authority via a certificate chain that ends in a publicly trusted root. hackney adds to every configuration. The callback returns any certificate in the peer chain whose public key matches a root in the bundled certifi store as the trust anchor, and OTP honours that callback over the configured . kept the callback when the caller replaced the trust store with or in , so a connection pinned to a private CA still accepted any chain that carried a publicly trusted root. The hostname check still applies, so the attacker needs a publicly trusted certificate for the pinned hostname. This issue affects hackney: from 1.24.0 before 4.9.0. ## Details **1. Default trust options.** builds the options for every TLS connection: the certifi , a hostname , and . The callback walks the peer chain and returns for the first certificate whose public key matches a root in the bundled certifi store, which lets OTP accept chains that end in a cross-signed root. **2. Merge keeps the callback.** When the caller passes , merges them over the defaults with the caller's values winning per key. or replace the trust store, and a removes the default , but has no counterpart in the caller's options and stays. **3. Validation.** OTP consults before the configured trust store. A peer chain that carries any publicly trusted root therefore gets that root as its trust anchor, and the pinned are never consulted. Only the hostname still constrains the attacker. ## Impact An attacker positioned between the client and a server pinned to a private CA, holding a publicly trusted certificate for the pinned hostname, can impersonate the server and read or modify the traffic the client sends and receives. ## Workarounds Pass your own in alongside or . A caller-supplied replaces hackney's in the merge, and a callback that returns makes OTP validate agai