CVE-2026-42784

A flaw was found in sequoia-openpgp. The library incorrectly infers key flags for older certificates when a key flags subpacket is missing, leading to a discrepancy in how key capabilities are viewed. This key flag confusion allows an attacker to bypass the back-signature check. Consequently, an attacker can illegitimately bind an arbitrary subkey to their own certificate and forge signatures, completely compromising cryptographic integrity.

This vulnerability in the sequoia-openpgp library allows for a critical compromise of cryptographic integrity. By exploiting a key flag confusion, an attacker can bypass signature validation, enabling the forgery of signatures and illegitimate binding of subkeys. This could impact Red Hat products that utilize sequoia-openpgp for OpenPGP operations, potentially leading to unauthorized actions or data manipulation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.