CVE-2026-42769: OpenSSL CMP Root CA Certificate Validation Bypass

Technical summary

CVE-2026-42769 involves a certificate verification failure in OpenSSL's handling of the 'id-it-rootCaKeyUpdate' CMP message type defined in RFC 9810. When processing root CA key rollover messages, the OSSL_CMP_get1_rootCaKeyUpdate() function is responsible for validating the 'newWithOld' certificate (the new root CA cert signed by the old root CA key) to establish trust chain continuity. A typo in the certificate chain building logic incorrectly adds the 'newWithOld' certificate itself to the verification chain instead of the 'oldRoot' certificate, nullifying cryptographic signature verification. The verification code then only checks issuer name and algorithm OIDs—insufficient to prevent substitution of an arbitrary self-signed certificate. An attacker with RA-level CMP message protection credentials can craft a malicious 'id-it-rootCaKeyUpdate' message containing their own certificate, which vulnerable clients will accept as a valid new trust anchor. FIPS-mode OpenSSL is unaffected as the vulnerable code lies outside FIPS module boundaries.

Business impact

Successful exploitation enables privilege escalation from RA to root CA level within PKI deployments relying on OpenSSL CMP clients. An attacker could issue arbitrary certificates, intercept encrypted communications, and impersonate any entity in the affected trust domain. Organizations using CMP for automated root CA key rotation face potential compromise of their entire certificate infrastructure. However, real-world impact is constrained by the precondition of needing valid RA credentials—typically limiting attacks to insider threats, compromised RA systems, or scenarios where an attacker has already breached the PKI registration service. Remediation requires patching and verification that no unauthorized root CA certificates were installed during key rotation operations.

Affected systems

OpenSSL versions containing the vulnerable CMP implementation are affected. The defect applies specifically to OpenSSL installations outside FIPS mode. Organizations should identify all CMP client deployments using non-FIPS OpenSSL that perform or accept root CA key rollover operations. Common scenarios include automated certificate renewal systems, distributed PKI client nodes, and certificate management appliances. OpenSSL FIPS module instances are inherently protected by architectural separation, but hybrid deployments mixing FIPS and non-FIPS code paths require careful inventory.

Exploitability

The vulnerability carries a CVSS 3.1 score of 5.3 (Medium severity) with a vector reflecting low attack complexity but high privilege bar: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N. Exploitation requires the attacker to already possess valid RA-level credentials and CMP message protection keys—a significant precondition that restricts the threat to scenarios involving insider access, credential compromise, or RA infrastructure breach. The attack is network-accessible and requires no user interaction once credentials are obtained. Practical exploitation depends on timing access to a legitimate root CA key rollover window and injecting the malicious 'id-it-rootCaKeyUpdate' message into the CMP transaction flow. The vulnerability is not currently tracked in CISA's Known Exploited Vulnerabilities (KEV) catalog.

Remediation

Apply security updates from OpenSSL that correct the certificate chain building logic in the OSSL_CMP_get1_rootCaKeyUpdate() function. Verify the patch against the official OpenSSL security advisory to confirm the typo fix and restoration of proper 'oldRoot' certificate chain construction. Organizations should also audit recent root CA key rollover operations in their CMP logs to detect whether any unauthorized root certificates were installed. Consider implementing additional monitoring on CMP message processing to alert on certificate verification anomalies. If root CA compromise is suspected, conduct a forensic review of issued certificates and consider revoking the affected root and reissuing the complete certificate hierarchy.

Patch guidance

Consult the OpenSSL security advisory accompanying this CVE for specific patched version numbers and release dates. Apply patches to all non-FIPS OpenSSL deployments, prioritizing systems actively performing CMP-based root CA key rollover. Test patches in a staging environment with a known root CA rollover cycle to verify that certificate chain verification is properly enforced before production deployment. Coordinate patching with your PKI lifecycle schedule to avoid disrupting planned key rotation windows. Note that systems running OpenSSL in FIPS mode do not require remediation, though maintaining parity across your OpenSSL fleet is advisable for consistency.

Detection guidance

Monitor CMP transaction logs and OpenSSL debug output for any 'id-it-rootCaKeyUpdate' message processing, particularly entries that succeed in installing a new root CA certificate. Anomalies include: certificate chain verification steps that appear to be skipped or incomplete, unexpected root certificates in the trust store post-rollover, or multiple rollover messages for the same root CA within an abnormal timeframe. Implement logging of the full 'newWithOld' certificate content during verification to enable forensic analysis. If available, enable OpenSSL diagnostic logging or use packet-level capture of CMP protocol exchanges to reconstruct the certificates presented in recent key rollover events. Cross-reference installed root certificates with your PKI documentation to identify any out-of-band additions.

Why prioritize this

Prioritize remediation based on the scope of your CMP client deployment and the frequency of root CA key rollover operations. Organizations actively using CMP for automated PKI management should patch immediately, as they represent the most likely attack surface. Insider threat and supply-chain compromise scenarios elevate risk if your RA infrastructure or CMP client systems are high-value targets. However, the requirement for pre-existing RA credentials significantly constrains the threat model—this is not a wormable or widespread network vulnerability. Patch scheduling should integrate with planned root CA key rotation activities to minimize operational disruption while closing the window of exposure.

Risk score, explained

The CVSS 3.1 score of 5.3 reflects a Medium severity rating driven by the high confidentiality impact (C:H) of potential certificate abuse, offset by the substantial privilege and complexity preconditions. A successful attacker can issue forged certificates without detection (confidentiality breach of trust), but cannot directly cause service unavailability or data corruption (I and A are N). The AC:H (High attack complexity) and PR:L (Low privilege requirement, interpreted as RA-level credentials) appropriately capture the significant setup barrier. The rating correctly avoids either overstating the risk (given the credential precondition) or understating it (given the severity of root CA compromise if successful). Organizations should apply their own risk context: insider-threat-heavy environments may warrant upgrading priority despite the CVSS rating.

Frequently asked questions