Red HatCVE-2026-42784
Red Hat sequoia-openpgp. The: improper signature check
High7.4CVE-2026-42784 · Published Sep 16, 2026 · updated Sep 23, 2026
A flaw was found in sequoia-openpgp. The library incorrectly infers key flags for older certificates when a key flags subpacket is missing, leading to a discrepancy in how key capabilities are viewed. This key flag confusion allows an attacker to bypass the back-signature check. Consequently, an attacker can illegitimately bind an arbitrary subkey to their own certificate and forge signatures, completely compromising cryptographic integrity.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| Confidential Compute Attestation Product | all versions | No fix yet |
| all versions | No fix yet | |
| all versions | No fix yet | |
| all versions | No fix yet | |
| all versions | No fix yet | |
| Red Hat Ansible Automation Platform 2 Product | all versions | No fix yet |
| all versions | No fix yet | |
| all versions | No fix yet | |
| Red Hat Enterprise Linux 10 Product | all versions | No fix yet |
| all versions | No fix yet | |
| all versions | No fix yet |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N
- Severity from
- the vendor (its own CVE record or advisory)
- Weakness
- CWE-347
More Red Hat advisories
All Red Hat| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Sep 16 | Red Hat Quay 3: attacker could inject arbitrary code | High8.0 | No fix yet |
| Sep 16 | Red Hat flightctl: race condition | Medium6.6 | No fix yet |
| Sep 16 | Red Hat first-broker-login flow: improper authentication | Medium5.3 | No fix yet |
| Sep 16 | Red Hat Data Grid 8: missing authorization | High7.2 | No fix yet |
| Sep 16 | Red Hat build of Keycloak: resource exhaustion | High7.5 | No fix yet |
| Sep 16 | Red Hat Single Sign-On 7: path traversal | High8.1 | No fix yet |