Read the docs
TI-2026-67472 Aliases CVE-2026-71885GHSA-jch3-5j66-88vx

MLS X.509 credential not bound to the LeafNode signature key

Priority MEDIUM 41CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Security bypass, Spoofing
Confidentiality · integrity · availability
High · High · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-287 and CWE-295.

Summary

In Bouncy Castle for Java before 1.86, the Messaging Layer Security (MLS, RFC 9420) implementation did not bind an X.509 credential to a LeafNode's signature_key. LeafNode.verify() checked a leaf's signature against the signature_key carried in the leaf itself, while the credential's X.509 certificate chain was stored but never parsed or validated, so the end-entity certificate's public key was never required to match signature_key as RFC 9420 sec. 5.3 requires. A party could therefore present another party's certificate as its credential while signing the leaf, and the enclosing KeyPackage, with an unrelated key, and be accepted under that other party's identity through KeyPackage.verify() and the Group leaf-validation path. In a deployment that admits external commits without an independent credential-admission check, an unauthenticated attacker could be admitted under a victim's X.509 identity, evict the victim (resynchronization compares whole credentials rather than signing keys), derive the current epoch, decrypt subsequent group messages, and send messages accepted as the victim. TreeKEM.LeafNode now requires the end-entity certificate's subject public key, in the cipher suite's signature encoding, to equal signature_key for an X.509 credential and rejects the leaf otherwise, including an empty chain or a certificate whose key type does not match the cipher suite; certificate-chain and identity validation to a trust anchor remain the application's responsibility per RFC 9420 sec. 5.3.1. Deployments using only basic credentials are unaffected.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00198 9th percentileScored 2026-11-07
Fix Fixed BC-JAVA (Legion of the Bouncy Castle Inc.): 1.86

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Legion of the Bouncy Castle Inc.BC-JAVAbefore 1.861.86Patch availableCNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:bouncycastle:bc-java:*:*:*:*:*:*:*:*——Legion of the Bouncy Castle Inc.

Remediation

  • Fix · CNA BC-JAVA (Legion of the Bouncy Castle Inc.) Fixed in 1.86

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Legion of the Bouncy Castle BC-JAVA 1.86

    11 records Highest priority Priority MEDIUM 4 MEDIUM, 7 LOW

    Other records, highest priority first

    • TI-2026-67477 MLS external commit can remove an arbitrary group memberPriority MEDIUM 43
    • TI-2026-67476 PKIXCertPathReviewer does not apply X.509 name constraints to the target certificatePriority MEDIUM 43
    • TI-2026-67475 CMS AuthenticatedData exposes attacker-inserted authAttrs when digestAlgorithm is absentPriority MEDIUM 42
    Show all 11 records →

Timeline

  1. 2026-10-03 Threatist record created from CVE-2026-71885
  2. 2026-10-03 Alias added: GHSA-jch3-5j66-88vx
  3. 2026-10-04 Priority changed: MEDIUM → LOW
  4. 2026-10-05 CISA SSVC decision points changed
  5. 2026-10-05 Priority changed: LOW → MEDIUM

References

Patch 1

Advisory 1

  • TI-2018-15967 Legion of the Bouncy Castle Legion of the Bouncy Castle Java Cryptography APIs 1.58 up to… CVSS 3.1CRITICAL 9.8
  • TI-2017-09736 BouncyCastle JCE TLS Bleichenbacher/ROBOT CVSS 3.0HIGH 7.5
  • TI-2026-42545 MTI/A0 DH agreement exponentiates unvalidated peer value CVSS 4.0CRITICAL 9.3
  • TI-2026-42533 JSSE hostname verifier CN-fallback enabled by default despite documented opt-in CVSS 4.0CRITICAL 9.3
  • TI-2026-41816 Stapled OCSP response accepted without binding to the checked certificate CVSS 4.0CRITICAL 9.3
  • TI-2026-07701 Name Constraints bypass via trailing dot in rfc822Name and URI CVSS 4.0CRITICAL 9.3
See all 109 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences