{"id":"CVE-2026-129118","kind":"vulnerability","aliases":["CVE-2026-129118"],"related":[],"title":"C-Kermit: wildcard certificate matching lets attackers impersonate hosts over TLS","description":"C-Kermit 8.0.200 before 11.1.515 contains an improper certificate hostname validation vulnerability that allows attackers to impersonate hosts by abusing wildcard matching in dNSName_cmp() in ck_ssl.c. Attackers holding a trusted certificate with over-matching names containing asterisks, question marks, brackets, or empty labels can intercept credentials and data over Telnet, FTP, and HTTP TLS connections.","summary":"C-Kermit mishandles hostname checks in its TLS certificate code, so names containing asterisks, question marks, brackets or empty labels match when they should not. An attacker holding a trusted certificate with such names can intercept credentials and data sent over Telnet, FTP and HTTP TLS connections.","severity":"high","cvss":7.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["c-kermit","ftp","package","telnet","tls"],"not_affected_if":["no-tls-use","versions-outside-range"],"how_to_check":"- Check the installed C-Kermit version with `kermit -v` or the package manager; affected versions are 8.0.200 up to but not including 11.1.515.\n- Look for uses of C-Kermit that make TLS connections over Telnet, FTP or HTTP.","fix":"- C-Kermit: move to `11.1.515` or later (per the NVD range, fixed in 11.1.515).","status":"open","published_at":"2026-11-13T17:17:28+00:00","first_seen_at":"2026-11-13T17:48:00+00:00","triaged_at":"2026-11-13T17:48:51+00:00","updated_at":"2026-11-13T17:48:51+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-13T17:48:51Z","model":"claude-haiku-5-5","output":{"fix":"- C-Kermit: move to `11.1.515` or later (per the NVD range, fixed in 11.1.515).","reach":"network","title":"C-Kermit: wildcard certificate matching lets attackers impersonate hosts over TLS","impact":"medium","summary":"C-Kermit mishandles hostname checks in its TLS certificate code, so names containing asterisks, question marks, brackets or empty labels match when they should not. An attacker holding a trusted certificate with such names can intercept credentials and data sent over Telnet, FTP and HTTP TLS connections.","audience":"businesses","category":"package","nicknames":[],"who_cares":["c-kermit","telnet","ftp","tls"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"Credentials and data on TLS sessions can be intercepted by an impersonating host.","analyst_note":"product_name not listed in input; ecosystem and vendor page not confirmed.\n","how_to_check":"- Check the installed C-Kermit version with `kermit -v` or the package manager; affected versions are 8.0.200 up to but not including 11.1.515.\n- Look for uses of C-Kermit that make TLS connections over Telnet, FTP or HTTP.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["no-tls-use","versions-outside-range"],"who_is_affected":"Teams running C-Kermit 8.0.200 through 11.1.514 to make TLS connections over Telnet, FTP or HTTP. The attacker needs a publicly trusted certificate with over-matching names, so the risk is mainly to sessions where a client trusts certificates from a rogue or compromised issuer. Systems that do not use C-Kermit for TLS sessions can skip it.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000797,"input_tokens":4676,"output_tokens":658,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-129118':15A,18A '-2026':14A,17A '11.1.515':79C '8.0.200':77C 'abus':94C 'allow':88C 'asterisk':40B,114C 'attack':8A,53B,89C,103C 'bracket':43B,117C 'c':2A,20B,27B,75C 'c-kermit':1A,19B,26B,74C 'certif':5A,35B,57B,83C,107C 'check':31B 'ck':101C 'cmp':99C 'code':36B 'connect':73B,132C 'contain':39B,80C,113C 'credenti':63B,123C 'cve':13A,16A 'data':65B,125C 'dnsname':98C 'empti':45B,119C 'ftp':22B,69B,128C 'hold':54B,104C 'host':10A,92C 'hostnam':30B,84C 'http':71B,130C 'imperson':9A,91C 'improp':82C 'intercept':62B,122C 'kermit':3A,21B,28B,76C 'label':46B,120C 'let':7A 'mark':42B,116C 'match':6A,47B,96C,111C 'mishandl':29B 'name':38B,60B,112C 'over-match':109C 'packag':23B 'question':41B,115C 'sent':66B 'ssl.c':102C 'telnet':24B,68B,127C 'tls':12A,25B,34B,72B,131C 'trust':56B,106C 'valid':85C 'vulner':86C 'wildcard':4A,95C","nicknames":[],"mitigations":[],"who_affected":"Teams running C-Kermit 8.0.200 through 11.1.514 to make TLS connections over Telnet, FTP or HTTP. The attacker needs a publicly trusted certificate with over-matching names, so the risk is mainly to sessions where a client trusts certificates from a rogue or compromised issuer. Systems that do not use C-Kermit for TLS sessions can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ckermit","ftp","high","package","telnet","tls"],"campaign_type":null,"search_a":"'-129118':15A,18A '-2026':14A,17A 'attack':8A 'c':2A 'c-kermit':1A 'certif':5A 'cve':13A,16A 'host':10A 'imperson':9A 'kermit':3A 'let':7A 'match':6A 'tls':12A 'wildcard':4A","search_b":"'asterisk':40B 'attack':53B 'bracket':43B 'c':20B,27B 'c-kermit':19B,26B 'certif':35B,57B 'check':31B 'code':36B 'connect':73B 'contain':39B 'credenti':63B 'data':65B 'empti':45B 'ftp':22B,69B 'hold':54B 'hostnam':30B 'http':71B 'intercept':62B 'kermit':21B,28B 'label':46B 'mark':42B 'match':47B 'mishandl':29B 'name':38B,60B 'packag':23B 'question':41B 'sent':66B 'telnet':24B,68B 'tls':25B,34B,72B 'trust':56B","search_c":"'11.1.515':79C '8.0.200':77C 'abus':94C 'allow':88C 'asterisk':114C 'attack':89C,103C 'bracket':117C 'c':75C 'c-kermit':74C 'certif':83C,107C 'ck':101C 'cmp':99C 'connect':132C 'contain':80C,113C 'credenti':123C 'data':125C 'dnsname':98C 'empti':119C 'ftp':128C 'hold':104C 'host':92C 'hostnam':84C 'http':130C 'imperson':91C 'improp':82C 'intercept':122C 'kermit':76C 'label':120C 'mark':116C 'match':96C,111C 'name':112C 'over-match':109C 'question':115C 'ssl.c':102C 'telnet':127C 'tls':131C 'trust':106C 'valid':85C 'vulner':86C 'wildcard':95C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-31T01:36:55+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-129118","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-129118","severity":null,"published_at":"2026-11-13T17:17:28+00:00","modified_at":"2026-11-13T17:17:28+00:00","first_seen_at":"2026-11-13T17:48:00+00:00","fetched_at":"2026-11-13T17:48:00+00:00","note":null}],"documents":[{"id":148083,"url":"https://github.com/OpenKermit/ckermit/commit/8c60a2bd70f5a78e77ce5d140a17e7a9cdcd5e60","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":148076,"url":"https://github.com/OpenKermit/ckermit/releases/tag/v11.1.515","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":148077,"url":"https://github.com/OpenKermit/ckermit/security/advisories/GHSA-5pc4-gh6q-5h4w","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-31T01:36:55+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":148086,"url":"https://www.vulncheck.com/advisories/c-kermit-8.0.200-before-11.1.515-improper-certificate-hostname-matching-via-dnsname-cmp","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}