{"id":"CVE-2026-19552","kind":"vulnerability","aliases":["CVE-2026-19552"],"related":[],"title":"Python: ssl.get_server_certificate skips hostname check when ca_certs is given","description":"When ca_certs parameter was supplied to ssl.get_server_certificate() function, the identity of the certificate is not checked.","summary":"When a ca_certs file is passed to ssl.get_server_certificate(), Python verifies the certificate chain but does not check that the certificate matches the server's identity. A script relying on this call could be fooled into trusting a certificate that was issued for another host.","severity":"unknown","cvss":0.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["python","runtime"],"not_affected_if":["no-ca-certs-argument","no-get-server-certificate-calls"],"how_to_check":"- Search your code for calls to `ssl.get_server_certificate(` that pass `ca_certs=`\n- Check your Python version with `python3 --version` against the fixed versions below","fix":null,"status":"open","published_at":"2026-11-09T15:17:21+00:00","first_seen_at":"2026-11-09T15:27:07+00:00","triaged_at":"2026-11-09T15:28:13+00:00","updated_at":"2026-11-09T15:28:13+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-11-09T15:28:13Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Python: ssl.get_server_certificate skips hostname check when ca_certs is given","impact":"low","summary":"When a ca_certs file is passed to ssl.get_server_certificate(), Python verifies the certificate chain but does not check that the certificate matches the server's identity. A script relying on this call could be fooled into trusting a certificate that was issued for another host.","audience":"developers","category":"runtime","nicknames":[],"who_cares":["python"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Script trusts a certificate issued for a different host","analyst_note":"Check the Python security-announce post and the CPython issue for affected and fixed versions; the NVD entry gives no CVSS score.","how_to_check":"- Search your code for calls to `ssl.get_server_certificate(` that pass `ca_certs=`\n- Check your Python version with `python3 --version` against the fixed versions below","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-get-server-certificate-calls","no-ca-certs-argument"],"who_is_affected":"Only code that calls ssl.get_server_certificate() with the ca_certs parameter is exposed, because that combination skips the identity check. Services that do not call this function, or that fetch certificates another way, are not affected by this entry. The sources do not state which Python versions are affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000718,"input_tokens":4558,"output_tokens":524,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-19552':15A,18A '-2026':14A,17A 'anoth':66B 'ca':9A,23B,69C 'call':54B 'cert':10A,24B,70C 'certif':4A,31B,35B,43B,61B,77C,83C 'chain':36B 'check':7A,40B,86C 'could':55B 'cve':13A,16A 'file':25B 'fool':57B 'function':78C 'given':12A 'host':67B 'hostnam':6A 'ident':48B,80C 'issu':64B 'match':44B 'paramet':71C 'pass':27B 'python':1A,19B,32B 'reli':51B 'runtim':20B 'script':50B 'server':3A,30B,46B,76C 'skip':5A 'ssl.get':2A,29B,75C 'suppli':73C 'trust':59B 'verifi':33B","nicknames":[],"mitigations":[],"who_affected":"Only code that calls ssl.get_server_certificate() with the ca_certs parameter is exposed, because that combination skips the identity check. Services that do not call this function, or that fetch certificates another way, are not affected by this entry. The sources do not state which Python versions are affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["python","runtime","unknown"],"campaign_type":null,"search_a":"'-19552':15A,18A '-2026':14A,17A 'ca':9A 'cert':10A 'certif':4A 'check':7A 'cve':13A,16A 'given':12A 'hostnam':6A 'python':1A 'server':3A 'skip':5A 'ssl.get':2A","search_b":"'anoth':66B 'ca':23B 'call':54B 'cert':24B 'certif':31B,35B,43B,61B 'chain':36B 'check':40B 'could':55B 'file':25B 'fool':57B 'host':67B 'ident':48B 'issu':64B 'match':44B 'pass':27B 'python':19B,32B 'reli':51B 'runtim':20B 'script':50B 'server':30B,46B 'ssl.get':29B 'trust':59B 'verifi':33B","search_c":"'ca':69C 'cert':70C 'certif':77C,83C 'check':86C 'function':78C 'ident':80C 'paramet':71C 'server':76C 'ssl.get':75C 'suppli':73C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T14:12:16+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@python.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-19552","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19552","severity":null,"published_at":"2026-11-09T15:17:21+00:00","modified_at":"2026-11-09T15:17:21+00:00","first_seen_at":"2026-11-09T15:27:07+00:00","fetched_at":"2026-11-09T15:27:07+00:00","note":null}],"documents":[{"id":107841,"url":"https://mail.python.org/archives/list/security-announce@python.org/message/SXBD6BGHDBTGM4KSUMQEWYIQ5RO4BQ76/","title":"Python security-announce: [Security-announce][CVE-2026-19552] ssl.get_server_certificate(addr, ca_certs=...) verifies the chain but never the identity","kind":"advisory","source":"advisory","publisher":null,"text":"[Security-announce][CVE-2026-19552] ssl.get_server_certificate(addr, ca_certs=...) verifies the chain but never the identity\n\nThere is a LOW severity vulnerability affecting CPython. When ca_certs parameter was supplied to ssl.get_server_certificate() function, the identity of the certificate is not checked. Please see the linked CVE ID for the latest information on affected versions: * https://www.cve.org/CVERecord?id=CVE-2026-19552 * https://github.com/python/cpython/pull/161507","published_at":"2026-11-09T14:12:16+00:00","relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}