CVE-2026-115693: Custom cacerts or cacertfile do not restrict trust to the pinned CA in hackney

Severity: critical (CVSS 9.1 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-26 · updated 2026-10-26
Weakness: CWE-295

Description

Improper Certificate Validation vulnerability in hackney_ssl in benoitc hackney allows an on-path attacker to impersonate a server pinned to a private certificate authority via a certificate chain that ends in a publicly trusted root. hackney adds {partial_chain, fun hackney_ssl:partial_chain/1} to every verify_peer configuration. The callback returns any certificate in the peer chain whose public key matches a root in the bundled certifi store as the trust anchor, and OTP honours that callback over the configured cacerts. hackney_ssl:merge_ssl_opts/3 kept the callback when the caller replaced the trust store with cacerts or cacertfile in ssl_options, so a connection pinned to a private CA still accepted any chain that carried a publicly trusted root. The hostname check still applies, so the attacker needs a publicly trusted certificate for the pinned hostname. This issue affects hackney: from 1.24.0 before 4.9.0.

Summary

CVE-2026-115693 is an improper certificate validation flaw in hackney_ssl in benoitc hackney: when callers set cacerts or cacertfile in ssl_options, hackney still injects a partial_chain callback that trusts any chain ending in a publicly trusted root, so a connection pinned to a private CA can be impersonated by an on-path attacker holding a publicly trusted certificate for the pinned hostname (the hostname check still applies). Versions 1.24.0 through before 4.9.0 are affected. It is not listed in CISA KEV, but CVSS is 9.1 critical. Upgrade to hackney 4.9.0; if you cannot, avoid relying on cacerts/cacertfile pinning for trust decisions until patched.

CVE-2026-115693 ثغرة تحقق غير صحيح من الشهادات في hackney_ssl ضمن benoitc hackney: فعند تعيين cacerts أو cacertfile في ssl_options يظل hackney يضيف callback من نوع partial_chain يثق بأي سلسلة تنتهي بجذر موثوق عام، لذا يمكن لمهاجم على المسار انتحال خادم مثبّت على CA خاص باستخدام شهادة موثوقة عامة للاسم المضيف المثبّت (يبقى فحص الاسم المضيف مطبقاً). تتأثر الإصدارات من 1.24.0 وحتى ما قبل 4.9.0. الثغرة غير مدرجة في CISA KEV لكن خطورتها 9.1 حرجة. الحل الترقية إلى hackney 4.9.0، وإن تعذر ذلك فتجنب الاعتماد على تثبيت cacerts/cacertfile لقرارات الثقة حتى الترقية.

Affected products

benoitc hackney: from 1.24.0 before 4.9.0 — fixed in 4.9.0

How to fix

Upgrade to a fixed version: benoitc hackney 4.9.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-115693 or the next vulnerability affects your stack