Skip to content
Fencer Vulns
high 7.4

CVE-2026-42784 json

Sequoia-openpgp: sequoia-openpgp: cryptographic integrity compromise via key flag confusion

published 2026-09-16 53 d ago modified 2026-11-04 4 d ago also EUVD-2026-80888

cvss
7.4
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 24%
public exploits
0
none known

Summary

A flaw was found in sequoia-openpgp. The library incorrectly infers key flags for older certificates when a key flags subpacket is missing, leading to a discrepancy in how key capabilities are viewed. This key flag confusion allows an attacker to bypass the back-signature check. Consequently, an attacker can illegitimately bind an arbitrary subkey to their own certificate and forge signatures, completely compromising cryptographic integrity.

Patch / fix

  • Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9 0:0.1.34-1.el9ap
  • Red Hat Red Hat Enterprise Linux 10 0:1.3.0.2-1.el10_2, 0:1.4.0.1-2.el10_2, 0:1.10.2.1-1.el10_2
  • Red Hat Red Hat Enterprise Linux 9 0:1.10.2.1-1.el9_8
  • Red Hat Red Hat Cost Management On-Premise 1 1791460851
  • Red Hat Red Hat Hardened Images 0.3.2-4.hum1, 1.10.3-0.3.hum1
  • rust-sequoia-openpgp Debian 14 2.2.0-2

debian advisories DEBIAN-CVE-2026-42784

  • rust-sequoia-sq RHEL 10.2 1.4.0.1-2.el10_2
  • sequoia-sq RHEL 10.2 1.4.0.1-2.el10_2
  • rust-sequoia-sqv RHEL 10.2 1.3.0.2-1.el10_2
  • sequoia-sqv RHEL 10.2 1.3.0.2-1.el10_2
  • rust-rpm-sequoia RHEL 10.2 1.10.2.1-1.el10_2
  • rpm-sequoia RHEL 10.2 1.10.2.1-1.el10_2
  • rust-rpm-sequoia RHEL 9 1.10.2.1-1.el9_8
  • rpm-sequoia RHEL 9 1.10.2.1-1.el9_8

red hat advisories RHSA-2026:76737RHSA-2026:76735RHSA-2026:76734RHSA-2026:76733RHSA-2026:42902RHSA-2026:42078

  • rpm-sequoia AlmaLinux 9 1.10.2.1-1.el9_8
  • rpm-sequoia AlmaLinux 10 1.10.2.1-1.el10_2
  • sequoia-sqv AlmaLinux 10 1.3.0.2-1.el10_2
  • sequoia-sq AlmaLinux 10 1.4.0.1-2.el10_2

almalinux advisories ALSA-2026:76733ALSA-2026:76734ALSA-2026:76735ALSA-2026:76737

  • rust-sequoia-sq Rocky Linux 10 1.4.0.1-2.el10_2
  • rust-rpm-sequoia Rocky Linux 10 1.10.2.1-1.el10_2
  • rust-sequoia-sqv Rocky Linux 10 1.3.0.2-1.el10_2
  • rust-rpm-sequoia Rocky Linux 9 1.10.2.1-1.el9_8

rocky linux advisories RLSA-2026:76737RLSA-2026:76734RLSA-2026:76735RLSA-2026:76733

  • kata-containers-cc Azure Linux 3.0 3.15.0.aks0-23

azure linux advisories AZL-105170

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-42784 updated cvss 7.4

sequoia-openpgp: sequoia-openpgp: Cryptographic integrity compromise via key flag confusion

  • Red Hat Confidential Compute Attestation openshift-sandboxed-containers/osc-monitor-rhel9, openshift-sandboxed-containers/osc-rhel9-operator, openshift-sandboxed-containers/osc-operator-bundle, openshift-sandboxed-containers/osc-podvm-builder-rhel9, openshift-sandboxed-containers/osc-podvm-payload-rhel9
    affected: workaround, no fix available
  • Red Hat Ansible Automation Platform 2 ansible-automation-platform-26/hub-rhel9, ansible-automation-platform-27/hub-rhel9 Red Hat Enterprise Linux 10 rust-podman-sequoia 0.4.0~pqc.3-1.el10_2
    affected: workaround, no fix planned “Will not fix”
  • Red Hat OpenShift Container Platform 4 kata-containers Red Hat Satellite 6 python-pysequoia 0.1.33-1.el9pc, python3.12-pysequoia 0.1.33-1.el9pc
    affected: workaround, no fix available
  • Red Hat Trusted Profile Analyzer rhtpa/rhtpa-trustification-service-rhel9
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Ansible Automation Platform 2.6 for RHEL 9 python3.12-pysequoia 0.1.34-1.el9ap
    fixed: vendor fix RHSA-2026:34160
  • Red Hat Cost Management On-Premise 1 costmanagement/costmanagement-ui-rhel10 1791460851
    fixed: vendor fix RHSA-2026:79357
  • Red Hat Enterprise Linux AppStream (v. 10) sequoia-sq 1.4.0.1-2.el10_2, sequoia-sqv 1.3.0.2-1.el10_2, rust-sequoia-sq 1.4.0.1-2.el10_2, rust-sequoia-sqv 1.3.0.2-1.el10_2
    fixed: vendor fix RHSA-2026:76737
  • Red Hat Enterprise Linux BaseOS (v. 9) rpm-sequoia 1.10.2.1-1.el9_8, rust-rpm-sequoia 1.10.2.1-1.el9_8
    fixed: vendor fix RHSA-2026:76733
show 5 more
  • Red Hat Enterprise Linux BaseOS (v. 10) rpm-sequoia 1.10.2.1-1.el10_2, rust-rpm-sequoia 1.10.2.1-1.el10_2
    fixed: vendor fix RHSA-2026:76734
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) rpm-sequoia-devel 1.10.2.1-1.el9_8, rpm-sequoia-debuginfo 1.10.2.1-1.el9_8, rust-rpm-sequoia-debugsource 1.10.2.1-1.el9_8
    fixed: vendor fix RHSA-2026:76733
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) rpm-sequoia-devel 1.10.2.1-1.el10_2, rpm-sequoia-debuginfo 1.10.2.1-1.el10_2, rust-rpm-sequoia-debugsource 1.10.2.1-1.el10_2
    fixed: vendor fix RHSA-2026:76734
  • Red Hat Hardened Images podman-sequoia 0.3.2-4.hum1, rpm-sequoia 1.10.3-0.3.hum1, rust-podman-sequoia 0.3.2-4.hum1, rust-rpm-sequoia 1.10.3-0.3.hum1
    fixed: vendor fix RHSA-2026:42902
  • Red Hat Ansible Automation Platform 2.6 for RHEL 9 automation-hub 4.11.10-1.el9ap, python3.12-pyjwt 2.13.0-1.el9ap, python3.12-urllib3 2.7.0-1.el9ap, automation-controller 4.7.13-2.el9ap, python3.12-galaxy-ng 4.11.10-1.el9ap, automation-platform-ui 2.6.10-1.el9ap, +26 more Red Hat Enterprise Linux 9 trustee-guest-components Red Hat Enterprise Linux 10 trustee 0.15.0-2.el10, trustee-guest-components Red Hat Trusted Profile Analyzer rhtpa/rhtpa-rhel10
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
51 d ago

Exploit prediction

0.31% chance of exploitation in the next 30 days, higher than 24% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N

Affected products

  • Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9
  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Cost Management On-Premise 1
  • Red Hat Red Hat Hardened Images
  • Red Hat Confidential Compute Attestation
  • Red Hat Red Hat Ansible Automation Platform 2
  • Red Hat Red Hat OpenShift Container Platform 4
  • Red Hat Red Hat Satellite 6
  • Red Hat Red Hat Trusted Profile Analyzer

Classification

Weakness
  • CWE-347 Improper Verification of Cryptographic Signature

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.