Live › vulnerability › CVE-2026-115693
Go to dashboardhackney is an Erlang HTTP client, and versions from 1.24.0 before 4.9.0 keep a partial-chain callback even when callers replace the trust store with cacerts or cacertfile. An on-path attacker holding a publicly trusted certificate for the pinned hostname can impersonate that server and read or alter the traffic.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 14:30 UTC. All times on this page are UTC.
Applications that use hackney from 1.24.0 up to but not including 4.9.0 to connect over TLS while pinning a private certificate authority through ssl_options cacerts or cacertfile. Connections that rely on the default public trust store are not described as affected by the sources. Teams that do not use hackney can skip it.
No product ranges from the sources yet.
rebar.lock or rebar.config, or run rebar3 deps and look for hackney.ssl_options passing cacerts or cacertfile to hackney connections.4.9.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Certificate Validation vulnerability in hackney_ssl in benoitc hackney allows an on-path attacker to impersonate a server pinned to a private certificate authority via a certificate chain that ends in a publicly trusted root. hackney adds {partial_chain, fun hackney_ssl:partial_chain/1} to every verify_peer configuration. The callback returns any certificate in the peer chain whose public key matches a root in the bundled certifi store as the trust anchor, and OTP honours that callback over the configured cacerts. hackney_ssl:merge_ssl_opts/3 kept the callback when the caller replaced the trust store with cacerts or cacertfile in ssl_options, so a connection pinned to a private CA still accepted any chain that carried a publicly trusted root.
The hostname check still applies, so the attacker needs a publicly trusted certificate for the pinned hostname.
This issue affects hackney: from 1.24.0 before 4.9.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-115693")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.