CVE-2026-88648

A flaw was found in GnuTLS. An attacker controlling a subordinate Certificate Authority (CA) can exploit an incomplete X.509 certificate validation mechanism to bypass cross-domain Public Key Infrastructure (PKI) restrictions. This allows unauthorized certificates to be accepted as valid, potentially enabling the attacker to impersonate trusted domains and intercept secure communications.

This flaw is rated Moderate by Red Hat Product Security. GnuTLS performs incomplete X.509 certificate validation, which allows an attacker who controls a subordinate Certificate Authority (CA) to bypass cross-domain Public Key Infrastructure (PKI) restrictions and issue unauthorized certificates for domains outside that CA's scope. Applications that use GnuTLS to validate certificates may accept such forged certificates as valid, enabling the attacker to impersonate trusted domains and intercept or tamper with TLS-protected communications, with high impact to confidentiality and integrity and no direct impact on availability. Exploitation is complex: it requires the attacker to already control a subordinate CA within the target's trust hierarchy and to be in a position to intercept or redirect the target's network connections. Affected Red Hat products include Red Hat Enterprise Linux 6 through 10 (including the mingw-gnutls variant), Red Hat Hardened Images, and Fedora, where GnuTLS is used for X.509 path validation; fixes for these affected products are being pursued through their respective product streams. The Red Hat CVSS 3.1 score for this flaw is 7.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N); the overall impact rating is Moderate because successful exploitation depends on control of a trusted subordinate CA and a network interception position.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.