CVE-2026-42784: Sequoia-openpgp: sequoia-openpgp: cryptographic integrity compromise via key flag confusion

Versions reported by the vendor

Affected version ranges reported by the assigning authority (redhat). Independent of NVD's CPE analysis and usually ahead of it.

• Red Hat Confidential Compute Attestation

  • all versionsaffected
  • all versionsaffected
  • all versionsaffected
  • all versionsaffected
  • all versionsaffected

• Red Hat Red Hat Ansible Automation Platform 2

  • all versionsaffected
  • all versionsaffected

• Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9

  • 0:0.1.34-1.el9ap and laternot affected · rpm

• Red Hat Red Hat Cost Management On-Premise 1

  • 1791460851 and laternot affected · rpm

• Red Hat Red Hat Enterprise Linux 10

  • 0:1.10.2.1-1.el10_2 and laternot affected · rpm
  • 0:1.3.0.2-1.el10_2 and laternot affected · rpm
  • 0:1.4.0.1-2.el10_2 and laternot affected · rpm
  • all versionsaffected
  • all versionsunknown
  • all versionsunknown

• Red Hat Red Hat Enterprise Linux 9

  • 0:1.10.2.1-1.el9_8 and laternot affected · rpm
  • all versionsunknown

• Red Hat Red Hat Hardened Images

  • 0.3.2-4.hum1 and laternot affected · rpm
  • 1.10.3-0.3.hum1 and laternot affected · rpm

• Red Hat Red Hat OpenShift Container Platform 4

  • all versionsaffected

• Red Hat Red Hat Satellite 6

  • all versionsaffected
  • all versionsaffected

• Red Hat Red Hat Trusted Profile Analyzer

  • all versionsaffected
  • all versionsunknown

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2026-90954Busybox: busybox: dpkg-deb extraction-root escape via per-ar-member deferred symlink flush
  31Monitor
• CVE-2026-96512Sudo: sudo: tz environment variable allows bypass of notbefore/notafter time-based authorization
  31Monitor
• CVE-2026-78410Util-linux: util-linux: restricted bind mounts do not pin the source, allowing x-mount.owner/group/mode redirection
  31Monitor

Published before and after this one in the same product

• ← EarlierCVE-2026-18495Sep 11, 2026 · Libtiff: libtiff: heap-buffer overflow via numeric truncation in the jpeg raw passthrough
  24Monitor
• ← EarlierCVE-2026-85013Sep 15, 2026 · Environment-modules: command injection in environment-modules bash completion via malicious module names containing shell metacharacters
  29Monitor
• Later →CVE-2026-76781Sep 17, 2026 · Libxml2: libxml2: null pointer dereference parsing nextcatalog without catalog attribute
  22Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

The verifier takes the algorithm to verify with from the token’s own header. Untrusted data ends up deciding its own verification rule.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1const claims = jwt.verify(token, publicKey);

1const claims = jwt.verify(token, publicKey, {2  algorithms: ["RS256"],3  issuer: "https://id.example.com",4  audience: "portal",5});

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.