CVE-2026-109383

A flaw was found in undici. This vulnerability may allow a remote attacker to intercept or modify encrypted communications by bypassing custom certificate validation. The issue occurs because the Agent dispatcher discards caller-supplied Transport Layer Security (TLS) verification functions during internal configuration copying, causing the client to silently ignore application-specific checks such as certificate or public-key pinning.

This vulnerability is rated as having an Important severity for Red Hat products because an attacker positioned on the network could bypass custom cryptographic protections, allowing the interception or tampering of sensitive traffic. Standard system trust stores and default certificate chain validations are not compromised by this flaw, which reduces exposure for environments relying solely on standard public key infrastructure. The elevated risk is restricted to services and applications that configure specialized certificate validation handlers, such as explicit certificate or public key pinning, when establishing outbound connections.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.