What is CVE-2026-42784?

CVE-2026-42784 is a high-severity vulnerability in Red Hat Confidential Compute Attestation, classified under Improper Verification of Cryptographic Signature. CVSS score: 7.4/10. Published 2026-09-16.

How severe is CVE-2026-42784?

High severity. CVSS v3 base score is 7.4 out of 10.

Vulnerability in Red Hat Confidential Compute Attestation

CVE-2026-42784

A flaw was found in sequoia-openpgp. The library incorrectly infers key flags for older certificates when a key flags subpacket is missing, leading to a discrepancy in how key capabilities are viewed. This key flag confusion allows an attacker to bypass the back-signature check. Consequently, an attacker can illegitimately bind an arbitrary subkey to their own certificate and forge signatures, completely compromising cryptographic integrity.

CVSS v3 metric

CVSS v3 base score 7.4 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N.

Affected products

Weakness classification (CWE)

CWE-347 — Improper Verification of Cryptographic Signature

References

secalert@redhat.com (x_refsource_REDHAT, vdb-entry)
secalert@redhat.com (x_refsource_REDHAT, issue-tracking)

Frequently asked questions

What is CVE-2026-42784?: CVE-2026-42784 is a high-severity vulnerability in Red Hat Confidential Compute Attestation, classified under Improper Verification of Cryptographic Signature. CVSS score: 7.4/10. Published 2026-09-16.
How severe is CVE-2026-42784?: High severity. CVSS v3 base score is 7.4 out of 10.