CVE-2026-42784
High
Description
A flaw was found in sequoia-openpgp. The library incorrectly infers key flags for older certificates when a key flags subpacket is missing, leading to a discrepancy in how key capabilities are viewed. This key flag confusion allows an attacker to bypass the back-signature check. Consequently, an attacker can illegitimately bind an arbitrary subkey to their own certificate and forge signatures, completely compromising cryptographic integrity.
SeverityHigh
CVSS7.4
Exploit probability—
Product
Microsoft Azl3 Kata-containers-cc
PublishedSep 16, 2026
First seenSep 16, 2026
Weakness typeCWE-347CWE-347
How to fix
Vendor advisories
- access.redhat.com/errata/RHSA-2026:34160
- access.redhat.com/errata/RHSA-2026:42078
- access.redhat.com/errata/RHSA-2026:42902
- access.redhat.com/errata/RHSA-2026:76733
- access.redhat.com/errata/RHSA-2026:76734
- access.redhat.com/errata/RHSA-2026:76735
- access.redhat.com/errata/RHSA-2026:76737
- access.redhat.com/errata/RHSA-2026:79357
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| microsoft azl3_kata-containers-cc_3.15.0.aks0-21 | No range specified | — |
| microsoft azl3_kata-containers-cc_3.15.0.aks0-23 | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.