CVE-2026-69248: Python Cryptography Info Disclosure Flaw

CVE-2026-69248 Overview

CVE-2026-69248 is an improper certificate validation flaw in the python-cryptography package, which exposes cryptographic primitives and X.509 verification to Python developers. Versions prior to 49.0.0 mishandle wildcard DNS Subject Alternative Names (SANs) when a chain contains an intermediate CA with name constraints. The verifier accepts a leaf certificate whose wildcard SAN can expand beyond the permitted subtree, breaking the trust guarantees expected from constrained intermediates. This weakness maps to [CWE-295: Improper Certificate Validation].

Critical Impact
An attacker controlling a constrained intermediate CA can issue leaf certificates with wildcard SANs that python-cryptography accepts for names outside the permitted namespace, enabling impersonation of arbitrary sibling hostnames.

Affected Products

pyca/cryptography (python-cryptography) versions prior to 49.0.0
Python applications relying on cryptography.x509.verification for chain building and name constraint enforcement
Downstream projects and distributions bundling affected versions of the library

Discovery Timeline

2026-08-03 - CVE-2026-69248 published to NVD
2026-08-04 - Last updated in NVD database

Technical Details for CVE-2026-69248

Vulnerability Analysis

The defect lies in DNSConstraint::matches within the cryptography-x509-verification Rust crate that backs the python-cryptography X.509 verifier. When an intermediate CA carries a permittedSubtrees name constraint such as foo.example.com, RFC 5280 requires every DNS name asserted by a subordinate leaf to fall within that subtree. The verifier instead treated a leaf wildcard SAN like *.example.com as satisfying the more specific constraint, even though the wildcard expands to arbitrary siblings including bar.example.com. This confuses "the wildcard pattern intersects the permitted set" with "the wildcard pattern is contained by the permitted set," which are not equivalent for name-constraint semantics.

Root Cause

The root cause is a missing distinction between permittedSubtrees and excludedSubtrees (subtree kinds) when comparing a wildcard DNS pattern against a constraint. The patch introduces a SubtreeKind parameter into evaluate_single_constraint so wildcard evaluation is directional. A wildcard on the leaf must be strictly contained within a permitted subtree, not merely overlap it.

Attack Vector

An adversary needs control of an intermediate CA that has been constrained by a higher authority (for example, a corporate PKI delegating foo.example.com to a business unit). By issuing a leaf certificate with a wildcard SAN of *.example.com, the attacker obtains a certificate that vulnerable python-cryptography clients accept for any sibling hostname under example.com. The attack is network-reachable and requires no user interaction, though it depends on the presence of a constrained intermediate in the trust path.

rust

// Patch: introduce SubtreeKind so wildcard matching respects constraint direction
// src/rust/cryptography-x509-verification/src/lib.rs
fn evaluate_single_constraint<B: CryptoOps>(
    &self,
    kind: SubtreeKind,
    constraint: &GeneralName<'chain>,
    san: &GeneralName<'chain>,
    budget: &mut Budget,
)

Source: pyca/cryptography commit 4d035a4

Detection Methods for CVE-2026-69248

Indicators of Compromise

Leaf certificates presenting wildcard DNS SANs (*.example.com) that chain through an intermediate CA carrying a more specific permittedSubtrees DNS constraint.
TLS sessions terminated by Python services using cryptography versions below 49.0.0 while validating certificates issued by constrained intermediates.
Unexpected acceptance of certificates for hostnames that fall outside a documented delegated namespace.

Detection Strategies

Inventory Python environments and enumerate installed cryptography versions using pip show cryptography or SBOM tooling; flag anything below 49.0.0.
Parse issued and observed certificates for wildcard SANs and correlate with issuing intermediates whose name constraints are narrower than the wildcard scope.
Add unit tests to CI that build a synthetic chain (constrained intermediate + wildcard leaf) and assert that verification fails on the patched library version.

Monitoring Recommendations

Log and alert on TLS handshakes where the presented server certificate contains a wildcard SAN and chains through a name-constrained intermediate.
Monitor certificate transparency feeds for newly issued wildcard certificates under domains that should be governed by name-constrained sub-CAs.
Track dependency updates in application repositories to ensure cryptography>=49.0.0 is pinned across services.

How to Mitigate CVE-2026-69248

Immediate Actions Required

Upgrade python-cryptography to version 49.0.0 or later in all Python runtimes, containers, and build pipelines.
Rebuild and redeploy container images that vendor the library, including base images used by internal services and CI runners.
Audit private PKI hierarchies to confirm which intermediates carry name constraints and which relying parties consume them via python-cryptography.

Patch Information

The fix is delivered in pyca/cryptography 49.0.0 via pull request #14888 and commit 4d035a4. The patch threads a SubtreeKind value through wildcard SAN evaluation so permittedSubtrees and excludedSubtrees are handled with correct directional semantics. Full details are in the GHSA-m2h6-j472-rp4c advisory.

Workarounds

Where upgrading is not immediately possible, avoid relying on python-cryptography name-constraint enforcement as a security boundary and validate hostnames against an explicit allowlist in application code.
Remove or replace constrained intermediates whose scope is smaller than any wildcard SAN that downstream sub-CAs might issue, until relying parties are patched.
Restrict which CAs are trusted by Python services to only those under direct organizational control, reducing exposure to malicious constrained intermediates.

bash

# Upgrade python-cryptography across environments
pip install --upgrade 'cryptography>=49.0.0'

# Verify the installed version
python -c "import cryptography; print(cryptography.__version__)"

# Pin in requirements.txt
echo 'cryptography>=49.0.0' >> requirements.txt