CVE-2020-26117

In rfb/CSecurityTLS.cxx and rfb/CSecurityTLS.java in TigerVNC before 1.11.0, viewers mishandle TLS certificate exceptions. They store the certificates as authorities, meaning that the owner of a certificate could impersonate any server after a client had added an exception.

• CWE-295

• http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00025.htmlBroken Link, Mailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00024.htmlBroken Link, Mailing List, Third Party Advisory
• https://bugzilla.opensuse.org/show_bug.cgi?id=1176733Issue Tracking, Third Party Advisory
• https://github.com/TigerVNC/tigervnc/commit/20dea801e747318525a5859fe4f37c52b05310cbPatch, Third Party Advisory
• https://github.com/TigerVNC/tigervnc/commit/7399eab79a4365434d26494fa1628ce1eb91562bPatch, Third Party Advisory
• https://github.com/TigerVNC/tigervnc/commit/b30f10c681ec87720cff85d490f67098568a9cbaPatch, Third Party Advisory
• https://github.com/TigerVNC/tigervnc/commit/f029745f63ac7d22fb91639b2cb5b3ab56134d6ePatch, Third Party Advisory
• https://github.com/TigerVNC/tigervnc/releases/tag/v1.11.0Release Notes, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2020/10/msg00007.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00025.htmlBroken Link, Mailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00024.htmlBroken Link, Mailing List, Third Party Advisory
• https://bugzilla.opensuse.org/show_bug.cgi?id=1176733Issue Tracking, Third Party Advisory
• https://github.com/TigerVNC/tigervnc/commit/20dea801e747318525a5859fe4f37c52b05310cbPatch, Third Party Advisory
• https://github.com/TigerVNC/tigervnc/commit/7399eab79a4365434d26494fa1628ce1eb91562bPatch, Third Party Advisory
• https://github.com/TigerVNC/tigervnc/commit/b30f10c681ec87720cff85d490f67098568a9cbaPatch, Third Party Advisory
• https://github.com/TigerVNC/tigervnc/commit/f029745f63ac7d22fb91639b2cb5b3ab56134d6ePatch, Third Party Advisory
• https://github.com/TigerVNC/tigervnc/releases/tag/v1.11.0Release Notes, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2020/10/msg00007.htmlMailing List, Third Party Advisory

Published

Sep 27, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-26111cPanel before 90.0.10 allows self XSS via the WHM Edit DNS Z…6.1
• CVE-2020-26112The email quota cache in cPanel before 90.0.10 allows overwr…7.5
• CVE-2020-26113cPanel before 90.0.10 allows self XSS via WHM Manage API Tok…6.1
• CVE-2020-26114cPanel before 90.0.10 allows self XSS via the Cron Jobs inte…6.1
• CVE-2020-26115cPanel before 90.0.10 allows self XSS via the Cron Editor in…6.1
• CVE-2020-26116http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12…7.2
• CVE-2020-26118In SmartBear Collaborator Server through 13.3.13302, use of …8.8
• CVE-2020-2612Vulnerability in the Enterprise Manager Base Platform produc…6
• CVE-2020-26120XSS exists in the MobileFrontend extension for MediaWiki bef…6.1
• CVE-2020-26121An issue was discovered in the FileImporter extension for Me…7.5
• CVE-2020-26122Inspur NF5266M5 through 3.21.2 and other server M5 devices a…7.2
• CVE-2020-26124openmediavault before 4.1.36 and 5.x before 5.5.12 allows au…8.8