{"id":"CVE-2026-115693","kind":"vulnerability","aliases":["CVE-2026-115693"],"related":[],"title":"hackney (Erlang): pinned private CA certificate checks can be bypassed by MITM","description":"Improper Certificate Validation vulnerability in hackney_ssl in benoitc hackney allows an on-path attacker to impersonate a server pinned to a private certificate authority via a certificate chain that ends in a publicly trusted root. hackney adds {partial_chain, fun hackney_ssl:partial_chain/1} to every verify_peer configuration. The callback returns any certificate in the peer chain whose public key matches a root in the bundled certifi store as the trust anchor, and OTP honours that callback over the configured cacerts. hackney_ssl:merge_ssl_opts/3 kept the callback when the caller replaced the trust store with cacerts or cacertfile in ssl_options, so a connection pinned to a private CA still accepted any chain that carried a publicly trusted root.\n\nThe hostname check still applies, so the attacker needs a publicly trusted certificate for the pinned hostname.\n\nThis issue affects hackney: from 1.24.0 before 4.9.0.","summary":"hackney is an Erlang HTTP client, and versions from 1.24.0 before 4.9.0 keep a partial-chain callback even when callers replace the trust store with cacerts or cacertfile. An on-path attacker holding a publicly trusted certificate for the pinned hostname can impersonate that server and read or alter the traffic.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["elixir","erlang","hackney","package","tls"],"not_affected_if":["default-trust-store","no-hackney"],"how_to_check":"- Check the locked hackney version in `rebar.lock` or `rebar.config`, or run `rebar3 deps` and look for hackney.\n- Look for `ssl_options` passing `cacerts` or `cacertfile` to hackney connections.","fix":"- Upgrade hackney to `4.9.0` or later.","status":"open","published_at":"2026-10-26T14:16:31+00:00","first_seen_at":"2026-10-26T14:30:36+00:00","triaged_at":"2026-10-26T14:32:04+00:00","updated_at":"2026-10-26T14:32:04+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-26T14:32:04Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade hackney to `4.9.0` or later.","reach":"network","title":"hackney (Erlang): pinned private CA certificate checks can be bypassed by MITM","impact":"high","summary":"hackney is an Erlang HTTP client, and versions from 1.24.0 before 4.9.0 keep a partial-chain callback even when callers replace the trust store with cacerts or cacertfile. An on-path attacker holding a publicly trusted certificate for the pinned hostname can impersonate that server and read or alter the traffic.","category":"package","nicknames":[],"who_cares":["erlang","elixir","hackney","tls"],"confidence":0.7,"needs_auth":"no","worst_case":"attacker impersonates pinned server and reads or alters traffic","analyst_note":"","how_to_check":"- Check the locked hackney version in `rebar.lock` or `rebar.config`, or run `rebar3 deps` and look for hackney.\n- Look for `ssl_options` passing `cacerts` or `cacertfile` to hackney connections.","needs_analyst":false,"not_affected_if":["default-trust-store","no-hackney"],"who_is_affected":"Applications that use hackney from 1.24.0 up to but not including 4.9.0 to connect over TLS while pinning a private certificate authority through ssl_options cacerts or cacertfile. Connections that rely on the default public trust store are not described as affected by the sources. Teams that do not use hackney can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000628,"input_tokens":3546,"output_tokens":547,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-115693':15A,18A '-2026':14A,17A '1.24.0':33B,223C '4.9.0':35B,225C 'accept':192C 'add':115C 'affect':220C 'allow':87C 'alter':74B 'anchor':151C 'appli':205C 'attack':57B,92C,208C 'author':102C 'benoitc':85C 'bundl':145C 'bypass':10A 'ca':5A,190C 'cacert':50B,160C,177C 'cacertfil':52B,179C 'callback':41B,129C,156C,168C 'caller':44B,171C 'carri':196C 'certif':6A,62B,78C,101C,105C,132C,213C 'certifi':146C 'chain':40B,106C,117C,136C,194C 'chain/1':122C 'check':7A,203C 'client':29B 'configur':127C,159C 'connect':185C 'cve':13A,16A 'elixir':19B 'end':108C 'erlang':2A,20B,27B 'even':42B 'everi':124C 'fun':118C 'hackney':1A,21B,24B,82C,86C,114C,119C,161C,221C 'hold':58B 'honour':154C 'hostnam':66B,202C,217C 'http':28B 'imperson':68B,94C 'improp':77C 'issu':219C 'keep':36B 'kept':166C 'key':139C 'match':140C 'merg':163C 'mitm':12A 'need':209C 'on-path':54B,89C 'option':182C 'opts/3':165C 'otp':153C 'packag':22B 'partial':39B,116C,121C 'partial-chain':38B 'path':56B,91C 'peer':126C,135C 'pin':3A,65B,97C,186C,216C 'privat':4A,100C,189C 'public':60B,111C,138C,198C,211C 'read':72B 'replac':45B,172C 'return':130C 'root':113C,142C,200C 'server':70B,96C 'ssl':83C,120C,162C,164C,181C 'still':191C,204C 'store':48B,147C,175C 'tls':23B 'traffic':76B 'trust':47B,61B,112C,150C,174C,199C,212C 'valid':79C 'verifi':125C 'version':31B 'via':103C 'vulner':80C 'whose':137C","nicknames":[],"mitigations":[],"who_affected":"Applications that use hackney from 1.24.0 up to but not including 4.9.0 to connect over TLS while pinning a private certificate authority through ssl_options cacerts or cacertfile. Connections that rely on the default public trust store are not described as affected by the sources. Teams that do not use hackney can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T14:16:31+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115693","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115693","severity":null,"published_at":"2026-10-26T14:16:31+00:00","modified_at":"2026-10-26T14:16:31+00:00","first_seen_at":"2026-10-26T14:30:36+00:00","fetched_at":"2026-10-26T14:30:36+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}