Trust-Anchor Substitution in OpenSSL CMP rootCaKeyUpdate Handling
CVE-2026-42769 is a low-severity certificate validation flaw in OpenSSL's Certificate Management Protocol (CMP) handling of Root CA key rollover messages of type id-it-rootCaKeyUpdate. During processing via OSSL_CMP_get1_rootCaKeyUpdate(), OpenSSL is expected to validate the newWithOld certificate, which contains the new root CA certificate signed by the old root CA key and is critical for transferring trust from the old root CA to the new one. Due to a typo in the certificate chain building logic, the code adds the wrong certificate to the chain (newWithOld instead of oldRoot), making the signature verification effectively ineffectual. As a result, only limited properties such as issuer name and algorithm OIDs are checked by other code paths, rather than properly validating the trust transition. An attacker who already possesses CMP credentials sufficient to satisfy message protection checks at the Registration Authority (RA) level can craft an id-it-rootCaKeyUpdate message containing a self-signed arbitrary root certificate and cause affected CMP clients to accept it as a new trust anchor.
Are you exposed to this one?
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
Impact, mitigation & remediation
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
Impact
What an attacker gets, and what they’ve been doing with it.
Mitigation
If you can’t patch tonight, do this now.
Remediation
Patch, then assume compromise.
Exploits
No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
Affected products & vendors
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
Recent activity
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An OpenSSL vulnerability addressed in Alpine Linux 3.24.1 as part of the June 9, 2026 advisory.
A low-severity OpenSSL CMP root CA key update validation flaw caused by a certificate chain building typo, enabling trust-anchor substitution under significant preconditions.
The version that knows your environment.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.