Zero Radar
← feed
CriticalVulnerabilityCVE-2026-115693updated 26 Oct 2026, 14:21 UTC

hackney (Erlang HTTP client) can accept wrong certificates when pinned to a private CA

A program using this HTTP library to talk to a server that uses its own private certificate could be tricked into trusting a fake server. An attacker on the network path who holds a publicly trusted certificate for that same hostname could

Fixed in hackney 4.9.0Official source
SeverityCriticalCVSS 9.1 of 10
Being exploited?UnclearNo reports either way yet
Fix available?Yeshackney 4.9.0 · since 26 Oct 2026
How sure is this?Official sourceBacked by an official source

How the attack works simplified

  1. 1On-path attackerSits between client and server
  2. 2Public certificateHolds a trusted cert for the hostname
  3. 3Connection hijackedClient connects to attacker
  4. 4Chain acceptedPublic root wrongly trusted despite private CA pin
  5. ResultAttacker impersonates the pinned server

What happened

In hackney from 1.24.0 before 4.9.0, the partial_chain callback added to every verify_peer configuration is retained when callers replace the trust store with cacerts or cacertfile, so chains ending in a publicly trusted root from the bundled certifi store are accepted even when the connection is pinned to a private CA.

Why it is dangerous: Connections meant to be restricted to a private certificate authority can be intercepted by an on-path attacker who obtains a publicly trusted certificate for the pinned hostname, exposing traffic and credentials sent to that service.

Are you affected?

You are affected if you use hackney 1.24.0 up to (but not including) 4.9.0 and pin connections to a private CA via ssl_options cacerts or cacertfile.

hackney from 1.24.0 before 4.9.0

What to do

  1. Upgrade hackney to version 4.9.0 or later
  2. Review any code that pins private CAs via ssl_options cacerts or cacertfile and verify it after the upgrade
  3. Confirm TLS connections to internal services still validate correctly

Timeline

  1. 26 Oct 2026, 14:16 UTC
    Publicly disclosed
  2. 26 Oct 2026, 14:16 UTC
    Reported by NVD · NVD
  3. 26 Oct 2026, 14:21 UTC
    Picked up by Zero Radar

Sources 1 report, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-115693
CVSS
9.1 / 10
EPSS
0.3% chance of exploitation within 30 days
Disclosed
26 Oct 2026, 14:16 UTC
On Zero Radar
26 Oct 2026, 14:21 UTC (5 min after disclosure)
Last change
26 Oct 2026, 14:21 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

hackney (Erlang HTTP client) can accept wrong certificates when pinned to a private CA · Zero Radar