CVE-2026-42784: Sequoia-openpgp: sequoia-openpgp: cryptographic integrity compromise via key flag confusion

Severity: high (CVSS 7.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-16 · updated 2026-10-15
Weakness: CWE-347

Description

A flaw was found in sequoia-openpgp. The library incorrectly infers key flags for older certificates when a key flags subpacket is missing, leading to a discrepancy in how key capabilities are viewed. This key flag confusion allows an attacker to bypass the back-signature check. Consequently, an attacker can illegitimately bind an arbitrary subkey to their own certificate and forge signatures, completely compromising cryptographic integrity.

Affected products

Red Hat Confidential Compute Attestation: all versions
Red Hat OpenShift Container Platform 4.18: all versions
Red Hat Ansible Automation Platform 2: all versions
Red Hat Ansible Automation Platform 2.6 for RHEL 9: all versions — fixed in 0:0.1.34-1.el9ap
Red Hat Cost Management On-Premise 1: all versions — fixed in 1791460851
Red Hat Enterprise Linux 10: all versions — fixed in 0:1.10.2.1-1.el10_2, 0:1.3.0.2-1.el10_2, 0:1.4.0.1-2.el10_2
Red Hat Enterprise Linux 9: all versions — fixed in 0:1.10.2.1-1.el9_8
Red Hat Hardened Images: all versions — fixed in 0.3.2-4.hum1
Red Hat Satellite 6: all versions
Red Hat Trusted Profile Analyzer: all versions

How to fix

Upgrade to a fixed version: Red Hat Ansible Automation Platform 2.6 for RHEL 9 0:0.1.34-1.el9ap; Red Hat Cost Management On-Premise 1 1791460851; Red Hat Enterprise Linux 10 0:1.10.2.1-1.el10_2, 0:1.3.0.2-1.el10_2, 0:1.4.0.1-2.el10_2; Red Hat Enterprise Linux 9 0:1.10.2.1-1.el9_8; Red Hat Hardened Images 0.3.2-4.hum1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-42784 or the next vulnerability affects your stack