{"id":"CVE-2026-122098","kind":"vulnerability","aliases":["CVE-2026-122098"],"related":[],"title":"CAI Content Credentials: improper certificate validation enables security bypass and write access","description":"CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction.","summary":"CAI Content Credentials does not properly validate certificates, which can let an attacker bypass security checks. A successful attacker could gain unauthorized write access, though exploitation depends on conditions outside the attacker's control.","severity":"medium","cvss":5.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"CAI Content Credentials","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["cai-content-credentials","other"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T22:18:28+00:00","first_seen_at":"2026-11-10T22:27:28+00:00","triaged_at":"2026-11-10T22:30:58+00:00","updated_at":"2026-11-10T22:30:58+00:00","category":"other","confidence":0.4,"triage":{"at":"2026-11-10T22:30:58Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"CAI Content Credentials: improper certificate validation enables security bypass and write access","impact":"medium","summary":"CAI Content Credentials does not properly validate certificates, which can let an attacker bypass security checks. A successful attacker could gain unauthorized write access, though exploitation depends on conditions outside the attacker's control.","audience":"businesses","category":"other","nicknames":[],"who_cares":["cai-content-credentials"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"attacker bypasses security checks and gains unauthorized write access","analyst_note":"Find the vendor advisory and affected versions for CVE-2026-122098 and the conditions needed for exploitation; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-122098.","how_to_check":"unknown","plain_action":"","product_name":"CAI Content Credentials","needs_analyst":true,"not_affected_if":[],"who_is_affected":"The sources do not name the affected versions or the deployment conditions. Teams that run CAI Content Credentials should check whether they use it to verify content credentials and whether the vendor has published an advisory.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000698,"input_tokens":4562,"output_tokens":483,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-122098':15A,18A '-2026':14A,17A 'access':12A,49B,93C 'affect':64C 'attack':38B,44B,57B,80C,100C 'beyond':98C 'bypass':9A,39B,78C,86C 'cai':1A,19A,23B,26B,60C 'cai-content-credenti':22B 'certif':5A,33B,68C 'check':41B 'condit':54B,97C 'content':2A,20A,24B,27B,61C 'control':59B,102C 'could':45B,72C,81C 'credenti':3A,25B,28B,62C 'credentials':21A 'cve':13A,16A 'depend':52B,95C 'enabl':7A 'exploit':51B,94C,103C 'featur':77C 'gain':46B,90C 'improp':4A,67C 'interact':111C 'issu':106C 'let':36B 'leverag':82C 'measur':88C 'outsid':55B 'proper':31B 'requir':109C 'result':73C 'secur':8A,40B,76C,87C 'success':43B 'though':50B 'unauthor':47B,91C 'user':110C 'valid':6A,32B,69C 'vulner':70C,84C 'write':11A,48B,92C","nicknames":[],"mitigations":[],"who_affected":"The sources do not name the affected versions or the deployment conditions. Teams that run CAI Content Credentials should check whether they use it to verify content credentials and whether the vendor has published an advisory.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["caicontentcredentials","contentcredentials"],"ptokens":["cai","content","credentials"],"labels":["caicontentcredentials","medium","other","vendor"],"campaign_type":null,"search_a":"'-122098':15A,18A '-2026':14A,17A 'access':12A 'bypass':9A 'cai':1A,19A 'certif':5A 'content':2A,20A 'credenti':3A 'credentials':21A 'cve':13A,16A 'enabl':7A 'improp':4A 'secur':8A 'valid':6A 'write':11A","search_b":"'access':49B 'attack':38B,44B,57B 'bypass':39B 'cai':23B,26B 'cai-content-credenti':22B 'certif':33B 'check':41B 'condit':54B 'content':24B,27B 'control':59B 'could':45B 'credenti':25B,28B 'depend':52B 'exploit':51B 'gain':46B 'let':36B 'outsid':55B 'proper':31B 'secur':40B 'success':43B 'though':50B 'unauthor':47B 'valid':32B 'write':48B","search_c":"'access':93C 'affect':64C 'attack':80C,100C 'beyond':98C 'bypass':78C,86C 'cai':60C 'certif':68C 'condit':97C 'content':61C 'control':102C 'could':72C,81C 'credenti':62C 'depend':95C 'exploit':94C,103C 'featur':77C 'gain':90C 'improp':67C 'interact':111C 'issu':106C 'leverag':82C 'measur':88C 'requir':109C 'result':73C 'secur':76C,87C 'unauthor':91C 'user':110C 'valid':69C 'vulner':70C,84C 'write':92C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T22:18:28+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","cvss_by":"psirt@adobe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-122098","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122098","severity":null,"published_at":"2026-11-10T22:18:28+00:00","modified_at":"2026-11-10T22:18:28+00:00","first_seen_at":"2026-11-10T22:27:28+00:00","fetched_at":"2026-11-10T22:27:28+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}