CVE-2026-71886
Description
A flaw was found in Bouncy Castle. The OpenPGP certificate application programming interface (API) fails to verify whether a subkey possesses certification authority before validating third-party certifications or trust delegations. An attacker in possession of a restricted signing or encryption subkey can exploit this flaw to issue identity certifications or delegate trust that applications treat as authorized by the primary key. This improper validation bypasses key usage restrictions, leading to fraudulent identity verification.
Statement
A flaw was found in Bouncy Castle's OpenPGP certificate API. When processing third-party certifications or trust delegations, the API fails to verify whether an issuing subkey carries the required certification authority flag (CERTIFY_OTHER). An attacker possessing a compromised or restricted subkey—such as a signing-only or legacy RSA encryption subkey—can issue fraudulent identity certifications or direct-key delegations that applications treat as authorized by the primary key. This bypasses cryptographic key-usage constraints, leading to improper identity verification and integrity compromise.
Mitigation
Explicitly inspect key flags on issuing subkeys before accepting third-party certifications, or reject delegations originating from non-primary keys. Where feasible, avoid relying on high-level OpenPGP certificate evaluation APIs for trust decisions until upgraded.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.9 | N/A | N/A |
| Attack Vector | Network | N/A | N/A |
| Attack Complexity | High | N/A | N/A |
| Privileges Required | None | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | High | N/A | N/A |
| Availability Impact | None | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
