CVE-2026-40944: Oxia Information Disclosure Vulnerability

CVE-2026-40944 Overview

CVE-2026-40944 is a certificate validation bypass vulnerability in Oxia, a metadata store and coordination system. Prior to version 0.16.2, the trustedCertPool() function in the TLS configuration only parses the first PEM block from CA certificate files. When a CA bundle contains multiple certificates (e.g., intermediate + root CA), only the first certificate is loaded. This silently breaks certificate chain validation for mTLS, potentially allowing unauthorized connections that should be rejected by proper certificate validation.

Critical Impact

mTLS certificate chain validation is silently broken, allowing potential bypass of mutual authentication in environments relying on certificate bundles with intermediate CAs.

Affected Products

• Oxia metadata store versions prior to 0.16.2

Discovery Timeline

• 2026-04-21 - CVE CVE-2026-40944 published to NVD
• 2026-04-22 - Last updated in NVD database

Technical Details for CVE-2026-40944

Vulnerability Analysis

This vulnerability falls under CWE-295 (Improper Certificate Validation). The core issue lies in how the trustedCertPool() function processes PEM-encoded certificate files. When organizations deploy Oxia with CA bundles containing multiple certificates—a common practice in enterprise environments where certificate chains include intermediate and root CAs—the function fails to parse beyond the first PEM block.

This creates a dangerous scenario where certificate validation silently degrades. An attacker could potentially present a certificate signed by an intermediate CA that would normally be validated against the full chain, but because only the first certificate in the bundle is loaded, the validation logic operates with incomplete trust anchors.

The vulnerability is particularly insidious because it occurs silently without generating errors or warnings. Administrators may believe their mTLS configuration is properly validating certificate chains when in reality only partial validation is occurring.

Root Cause

The root cause is improper PEM parsing logic in the trustedCertPool() function. Standard PEM files can contain multiple certificate blocks, each delimited by -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- markers. The vulnerable implementation only processes the first such block, discarding any subsequent certificates in the file.

This design flaw violates the expectation that CA bundle files containing multiple certificates will have all certificates loaded into the trusted certificate pool for validation purposes.

Attack Vector

The attack vector is network-based and exploits the improper certificate validation. An attacker with knowledge of the incomplete certificate pool could potentially:

1. Present a certificate signed by an intermediate CA that is not loaded into the trust pool
2. Bypass mTLS authentication if the certificate chain validation relies on certificates beyond the first one in the bundle
3. Establish unauthorized connections to Oxia nodes configured with incomplete certificate validation

The vulnerability requires no authentication and can be exploited with low complexity over the network. However, exploitation is constrained to scenarios where organizations use multi-certificate CA bundles and the attacker can present certificates that exploit the incomplete trust chain.

For detailed technical information about this vulnerability, refer to the GitHub Security Advisory.

Detection Methods for CVE-2026-40944

Indicators of Compromise

• Unexpected successful TLS connections from clients with certificates that should fail validation
• Authentication events where certificate chain validation passes despite incomplete CA chains
• Log entries indicating mTLS handshakes succeeding with certificates not signed by the expected full CA chain

Detection Strategies

• Review Oxia server logs for TLS handshake patterns and certificate validation events
• Audit deployed CA bundle files to identify environments using multi-certificate bundles (files with multiple PEM blocks)
• Monitor for connections from unexpected certificate sources that should be rejected by proper chain validation
• Compare expected certificate validation behavior against actual connection acceptance patterns

Monitoring Recommendations

• Implement certificate transparency logging to track all certificates used for mTLS connections
• Deploy network monitoring to detect anomalous connection patterns to Oxia nodes
• Enable verbose TLS debugging temporarily in non-production environments to validate certificate chain processing

How to Mitigate CVE-2026-40944

Immediate Actions Required

• Upgrade Oxia to version 0.16.2 or later immediately
• Audit all CA bundle configurations to identify environments potentially affected
• Temporarily switch to single-certificate CA files if upgrade is not immediately possible
• Review recent connection logs for any suspicious mTLS authentication events

Patch Information

The vulnerability is fixed in Oxia version 0.16.2. The fix ensures that the trustedCertPool() function properly iterates through and parses all PEM blocks in CA certificate files, loading the complete certificate chain into the trust pool.

For patch details and upgrade instructions, see the GitHub Security Advisory.

Workarounds

• Split multi-certificate CA bundles into individual certificate files and configure Oxia to load each separately
• Use only single-certificate CA files until upgrade to 0.16.2 is completed
• Implement additional network-level access controls to restrict connections to Oxia nodes while operating with potentially weakened certificate validation
• Deploy certificate pinning at the application level as an additional validation layer