CVE-2026-115693— Custom cacerts or cacertfile do not restrict trust to the pinned CA in hackney

Quick assessment

Affected

benoitc hackney

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在（属于项目）中存在一个证书验证不当的漏洞。该漏洞允许处于中间位置的攻击者，通过一条以受公众信任的根证书为终点的证书链，伪装成已绑定到私有证书颁发机构（CA）的服务器。具体而言，会在所有配置中自动添加回调函数。该回调会返回对等方证书链中任何公钥与内置证书库中根证书匹配的证书，并将其作为信任锚点；而 OTP 会优先采纳该回调的结果，从而覆盖用户配置的。此外，在调用者通过中的或替换信任存储时，仍保留了该回调函数。因此，即使连接被显式绑定到私有 CA，系统仍会接受任何包含受公众信任根证书的证书链。

CVSS 9.1 · Critical Updated Oct 26, 2026

Possible ATT&CK Techniques 2 AI

T1538 · Cloud Service Dashboard T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Custom cacerts or cacertfile do not restrict trust to the pinned CA in hackney

Source: CVE Program / CVE List V5

Vulnerability Description

Improper Certificate Validation vulnerability in hackney_ssl in benoitc hackney allows an on-path attacker to impersonate a server pinned to a private certificate authority via a certificate chain that ends in a publicly trusted root. hackney adds {partial_chain, fun hackney_ssl:partial_chain/1} to every verify_peer configuration. The callback returns any certificate in the peer chain whose public key matches a root in the bundled certifi store as the trust anchor, and OTP honours that callback over the configured cacerts. hackney_ssl:merge_ssl_opts/3 kept the callback when the caller replaced the trust store with cacerts or cacertfile in ssl_options, so a connection pinned to a private CA still accepted any chain that carried a publicly trusted root. The hostname check still applies, so the attacker needs a publicly trusted certificate for the pinned hostname. This issue affects hackney: from 1.24.0 before 4.9.0.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Source: CVE Program / CVE List V5

Vulnerability Type

证书验证不恰当

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
benoitc	hackney	1.24.0 ~ 4.9.0	`cpe:2.3:a:benoitc:hackney::::::::`
benoitc	hackney	d8a9afcf5c3849904274e2eba1df56c63d1a1a0c ~ 915eb5737e9c489d8fc22eec8cdae30e9b027be4	`cpe:2.3:a:benoitc:hackney::::::::`

II. Public POCs for CVE-2026-115693

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-115693

请登录查看更多情报信息。

Other References for CVE-2026-115693 (6)

https://github.com/benoitc/hackney/releases/tag/4.9.0 vendor-advisory related
https://osv.dev/vulnerability/EEF-CVE-2026-115693 related
https://cna.erlef.org/cves/CVE-2026-115693.html related
https://github.com/benoitc/hackney/commit/915eb5737e9c489d8fc22eec8cdae30e9b027be4 patch
https://github.com/benoitc/hackney/commit/d8a9afcf5c3849904274e2eba1df56c63d1a1a0c related
https://github.com/benoitc/hackney/pull/978 related

https://www.cve.org/CVERecord?id=CVE-2026-115693

Same Patch Batch · benoitc · 2026-10-26 · 5 CVEs total

CVE-2026-97200	8.2 HIGH	Unbounded response body buffering and decompression in hackney
CVE-2026-115700	6.9 MEDIUM	SSRF allowlist bypass via percent-encoded bracketed IPv6 or trailing-dot IP literal in hac
CVE-2026-113440	6.0 MEDIUM	HTTP/1.1 and HTTP/2 redirects resend basic_auth and cookie to a different scheme or port i
CVE-2026-112880	2.1 LOW	CRLF injection in Proxy-Authorization header built from proxy_auth_fun in hackney

IV. Related Vulnerabilities

Same product: hackney

Same vendor: benoitc

Same weakness: CWE-295