CVE-2026-115693

Improper Certificate Validation vulnerability in hackney_ssl in benoitc hackney allows an on-path attacker to impersonate a server pinned to a private certificate authority via a certificate chain that ends in a publicly trusted root. hackney adds {partial_chain, fun hackney_ssl:partial_chain/1} to every verify_peer configuration. The callback returns any certificate in the peer chain whose public key matches a root in the bundled certifi store as the trust anchor, and OTP honours that callback over the configured cacerts. hackney_ssl:merge_ssl_opts/3 kept the callback when the caller replaced the trust store with cacerts or cacertfile in ssl_options, so a connection pinned to a private CA still accepted any chain that carried a publicly trusted root. The hostname check still applies, so the attacker needs a publicly trusted certificate for the pinned hostname. This issue affects hackney: from 1.24.0 before 4.9.0.

• CWE-295

• https://cna.erlef.org/cves/CVE-2026-115693.html
• https://github.com/benoitc/hackney/commit/915eb5737e9c489d8fc22eec8cdae30e9b027be4
• https://github.com/benoitc/hackney/commit/d8a9afcf5c3849904274e2eba1df56c63d1a1a0c
• https://github.com/benoitc/hackney/pull/978
• https://github.com/benoitc/hackney/releases/tag/4.9.0
• https://osv.dev/vulnerability/EEF-CVE-2026-115693

Published

Oct 26, 2026

Last Modified

Oct 26, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-11567The SureForms WordPress plugin before 2.11.1 does not prope…5.9
• CVE-2026-115678Arm Keil MDK-Middleware 8.0.0-8.3.0 may allow pre-authentica…5.3
• CVE-2026-115679Arm Keil MDK-Middleware 8.3.0 may allow out-of-bounds reads …6.5
• CVE-2026-11568The Product Configurator for WooCommerce WordPress plugin be…7.5
• CVE-2026-115680Arm Keil MDK-Middleware 8.0.0-8.3.0 may allow DHCPv6 Option-…6.5
• CVE-2026-11569A flaw was found in Quay. The filedrop endpoint accepts any …5.4
• CVE-2026-1157A vulnerability was identified in Totolink LR350 9.3.5u.6369…8.8
• CVE-2026-11570The User Submitted Posts WordPress plugin before 20260608 d…4.2
• CVE-2026-115700Interpretation Conflict vulnerability in hackney_url in beno…6.9
• CVE-2026-11571The Everest Forms WordPress plugin before 3.5.0 does not re…7.5
• CVE-2026-115717Frappe Builder versions before 1.36.1 contain a server-side …7.7
• CVE-2026-115718Frappe Builder versions 1.33.0 before1.36.0 contain a missin…4.3