CVE-2026-42784

HIGH 7.4

Sequoia-openpgp: sequoia-openpgp: cryptographic integrity compromise via key flag confusion

CVSS Score

7.4

EPSS Score

0.0%

EPSS Percentile

0th

A flaw was found in sequoia-openpgp. The library incorrectly infers key flags for older certificates when a key flags subpacket is missing, leading to a discrepancy in how key capabilities are viewed. This key flag confusion allows an attacker to bypass the back-signature check. Consequently, an attacker can illegitimately bind an arbitrary subkey to their own certificate and forge signatures, completely compromising cryptographic integrity.

CWE	CWE-347
Vendor	red hat
Product	confidential compute attestation
Published	Sep 16, 2026

Stay Ahead of the Next One

Get instant alerts for red hat confidential compute attestation

Be the first to know when new high vulnerabilities affecting red hat confidential compute attestation are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

None

Integrity

High

Availability

None

Affected Versions

Red Hat / Confidential Compute Attestation

All versions affected

Red Hat / Confidential Compute Attestation

All versions affected

Red Hat / Confidential Compute Attestation

All versions affected

Red Hat / Confidential Compute Attestation

All versions affected

Red Hat / Confidential Compute Attestation

All versions affected

Red Hat / Red Hat Ansible Automation Platform 2

All versions affected

Red Hat / Red Hat Ansible Automation Platform 2

All versions affected

Red Hat / Red Hat Ansible Automation Platform 2

All versions affected