LiveActive security incident?Get immediate response
CVE Record

CVE-2026-57826: An issue was discovered in openHiTLS 0.2.0 through 0.3.2.

An issue was discovered in openHiTLS 0.2.0 through 0.3.2. In the X.509 certificate chain verification, the basic constraints extension and CA flag processing of intermediate CAs are only verified for v3 certificates, and v1/v2 certificates are ignored.

CriticalCVSS 9.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysiscritical

Security readout for executives and security teams

Plain-English summary

openHiTLS may accept an invalid certificate chain because older v1/v2 intermediate certificates do not receive required CA checks. In affected systems, this can undermine certificate-based identity and trust, potentially enabling impersonation or interception where an attacker can present a malicious chain. The bundle identifies versions 0.2.0 through 0.3.2 as affected.

Executive priority

Immediately determine whether affected openHiTLS versions are present in trust-sensitive systems. If present, expedite vendor-guided remediation because the defect can invalidate certificate-based authentication boundaries and carries CVSS 9.8. Prioritize externally reachable services and systems accepting certificates from outside administrative control. Active exploitation is not established in the supplied evidence.

Technical view

CVE-2026-57826 is a CWE-295 certificate-validation flaw. During X.509 chain verification, openHiTLS applies intermediate-CA Basic Constraints and CA-flag checks only to v3 certificates, ignoring v1/v2 intermediates. This can allow an intermediate lacking valid CA authorization to pass validation. CVSS 3.1 is 9.8: network reachable, low complexity, no privileges, and no user interaction.

Likely exposure

Exposure exists wherever openHiTLS 0.2.0 through 0.3.2 is deployed and its X.509 verifier evaluates certificate chains. Risk is greatest when external parties can supply chains used for authentication or trust decisions. The bundle names no downstream products or CPEs, so organizations must identify direct, transitive, embedded, and statically linked copies.

Exploitation context

The bundle provides no evidence of active exploitation, public proof-of-concept code, or CISA KEV inclusion; KEV is explicitly false. The CVSS vector indicates remote reachability with no privileges or user interaction. Actual exploitability depends on whether an application processes certificate chains supplied by an untrusted party.

Researcher notes

The key defect is version-dependent validation: v3 intermediates receive Basic Constraints and CA-flag checks, while v1/v2 intermediates are skipped. Review the 0.3.2-to-0.3.3 comparison and referenced commits for exact code changes and regression coverage. The evidence does not establish affected downstream products, a public exploit, active exploitation, or a vendor-endorsed workaround.

Mitigation direction

  • Inventory applications, appliances, firmware, containers, and statically linked binaries containing openHiTLS 0.2.0 through 0.3.2.
  • Consult HTLS-2026-001 and move affected deployments to the vendor-confirmed fixed release.
  • Prioritize systems making certificate-based trust decisions for external or otherwise untrusted inputs.
  • Follow downstream product vendors when openHiTLS is embedded and cannot be upgraded independently.

Validation and detection

  • Confirm the library version actually loaded at runtime, including embedded and statically linked copies.
  • Review SBOMs, lockfiles, build manifests, firmware inventories, and container contents for the affected range.
  • After remediation, verify chains with unauthorized v1/v2 intermediates are rejected by certificate validation.
  • Rebuild or restart affected workloads, then confirm the fixed library is present in deployed artifacts.
Prepared
Confidence
high
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-295: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2026-57826 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Critical
CVSS
9.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
1ADP providers
7Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: yesTechnical Impact: total

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
9.8CVSS 3.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9CISA-ADP

Vulnerability scoring details

Base CVSS 3.1 score

9.8Critical
CVSS 3.1 vector shape for CVE-2026-57826Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
cvssV3_1other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

CWE-295

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-295 · source CWE mapping

Improper Certificate Validation

Improper Certificate Validation represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs