CVE-2026-69248

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In versions 45.0.0 through 48.0.0, if an intermediate constrained CA permits the DNS name foo.example.com, and the leaf certificate has a wildcard in its DNS SAN of *.example.com, python-cryptography's verifier accepts which allows escaping outside of the permitted names. The core issue is in DNSConstraint::matches, where a wildcard pattern was treated as matching a more-specific permitted constraint even though *.example.com can expand to sibling names such as bar.example.com outside foo.example.com. This allows acceptance of an invalid certificate chain. This issue is fixed in 49.0.0.

• CWE-295

• https://github.com/pyca/cryptography/commit/4d035a4225965edeffd312079a510ef25fcfdcb2
• https://github.com/pyca/cryptography/pull/14888
• https://github.com/pyca/cryptography/security/advisories/GHSA-m2h6-j472-rp4c
• https://github.com/pyca/cryptography/security/advisories/GHSA-m2h6-j472-rp4c

Published

Aug 3, 2026

Last Modified

Sep 10, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-69242libvips is a fast image processing library with low memory n…8.4
• CVE-2026-69243AIOHTTP is an asynchronous HTTP client/server framework for …6.3
• CVE-2026-69244AIOHTTP is an asynchronous HTTP client/server framework for …7.1
• CVE-2026-69245Guzzle is an extensible PHP HTTP client. Prior to 7.15.2 and…6.5
• CVE-2026-69246Guzzle is an extensible PHP HTTP client. Prior to 7.15.2 and…7.2
• CVE-2026-69247cryptography is a package designed to expose cryptographic p…8.2
• CVE-2026-69249python-cryptography is a package designed to expose cryptogr…8.7
• CVE-2026-6925IBM Concert 1.0.0 through 3.0.0 could allow a remote attacke…5.3
• CVE-2026-69250Flowise is a drag & drop user interface to build a customize…7.5
• CVE-2026-69251Flowise is a drag & drop user interface to build a customize…8.8
• CVE-2026-69252Flowise is a drag & drop user interface to build a customize…8.8
• CVE-2026-69253Flowise is a drag-and-drop user interface for building custo…8.8