CVE-2026-6091 — Partial-chain verification accepts untrusted intermediate as trust anchor
Partial-chain certificate verification may accept chains that terminate at a peer-supplied, untrusted intermediate certificate rather than a trusted anchor. An attacker could pr…
Published: 2026-06-25 · CVSS: 6.0 · CVSS 4.0
Partial-chain certificate verification may accept chains that terminate at a peer-supplied, untrusted intermediate certificate rather than a trusted anchor. An attacker could present a chain that ends at an intermediate they control and have it accepted as valid. This affects the OpenSSL compatibility certificate-path-building path (wolfSSL_X509_verify_cert / X509_STORE, OPENSSL_EXTRA) when the X509_V_FLAG_PARTIAL_CHAIN verify flag is enabled.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7