CVE-2026-115693

The record

Improper Certificate Validation vulnerability in hackney_ssl in benoitc hackney allows an on-path attacker to impersonate a server pinned to a private certificate authority via a certificate chain that ends in a publicly trusted root. hackney adds {partial_chain, fun hackney_ssl:partial_chain/1} to every verify_peer configuration. The callback returns any certificate in the peer chain whose public key matches a root in the bundled certifi store as the trust anchor, and OTP honours that callback over the configured cacerts. hackney_ssl:merge_ssl_opts/3 kept the callback when the caller replaced the trust store with cacerts or cacertfile in ssl_options, so a connection pinned to a private CA still accepted any chain that carried a publicly trusted root. The hostname check still applies, so the attacker needs a publicly trusted certificate for the pinned hostname. This issue affects hackney: from 1.24.0 before 4.9.0.

Affected packages

Related vulnerabilities

• CVE-2026-121565 Tanium addressed an improper certificate validation vulnerability in multiple products. CWE-295
• CVE-2026-121624 Nanosystems Supremo for Windows and macOS before 5.0.2.3874 contains an improper… CWE-295
• CVE-2026-115714 Improper Certificate Validation (CWE-295) in the operating system certificate bundle… CWE-295
• CVE-2026-121452 bbs-go through 4.4.6 contains an improper certificate validation vulnerability that… CWE-295
• CVE-2026-121392 FreeRDP before 3.32.2 contains an improper certificate validation vulnerability in… CWE-295
• CVE-2026-91897 Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain an Improper… CWE-295
• CVE-2026-120250 OpenAlgo 1.0.0.29 before 2.0.3.1 contains an improper certificate validation… CWE-295
• CVE-2026-118147 Improper certificate validation in Visual Studio allows an unauthorized attacker to… CWE-295