Executive brief
OpenSSL is a widely used security library that provides encrypted communications and certificate management. A flaw in its certificate management protocol (CMP) could allow an attacker with existing administrative-level credentials to trick clients into accepting a fake root certificate. This could allow the attacker to impersonate the central authority that validates all other security certificates in the network.
Technical details
A vulnerability exists in the OSSL_CMP_get1_rootCaKeyUpdate() function of OpenSSL due to a typo in the certificate chain building logic. During a Root CA key rollover (RFC 9810), the code incorrectly adds the 'newWithOld' certificate to the chain instead of the 'oldRoot' certificate, effectively bypassing signature verification. An attacker who already possesses valid Registration Authority (RA) credentials can exploit this by sending a crafted 'id-it-rootCaKeyUpdate' message containing a self-signed certificate. Affected clients will accept this malicious certificate as a new trust anchor, allowing the attacker to replace the legitimate root CA. The FIPS module is not affected.
Affected products
- OpenSSL Foundation OpenSSL OpenSSL 3.0, 3.4, 3.5, 3.6, 4.0
Timeline
- 2026-06-09: disclosed
- 2026-06-09: advisory
References
- https://github.com/openssl/security/commit/54d0989997e5fc26057009a9782c3441ce3842fb
- https://github.com/openssl/security/commit/777b363b16fcf2153bb3ded39dc3838713667c44
- https://github.com/openssl/security/commit/d35cd473a271bf3ce7bf3d32af53217fb83ae92c
- https://github.com/openssl/security/commit/d531f21c0fe99067a66fc0ff1161ef127f9cd70b
- https://openssl-library.org/news/secadv/20260609.txt