Read the docs
TI-2026-71019 Aliases CVE-2026-103503

Improper certificate validation in Hex when cacerts_path is set

Priority LOW 26CWE-295Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Active
Attack complexity
High
Attack requirements
Present
Impact type
Spoofing
Confidentiality · integrity · availability
High · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-295.

Summary

Hex from 0.20.2 before 2.5.2 accepts server certificate chains that lead to a CA in its bundled store even when users set cacerts_path to a CA store that omits that CA (CWE-295). The partial chain check passes any chain containing a certificate with the same public key as a bundled CA. An attacker who can intercept HTTPS connections and holds a certificate for a Hex host issued by such a bundled CA can impersonate that host to affected users. Hostname verification still applies.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Improper Certificate Validation vulnerability in hexpm hex allows an attacker who can intercept HTTPS connections, and holds a certificate for a Hex host issued by a CA in Hex's bundled CA store, to impersonate that host to users who set cacerts_path to a CA store that leaves that CA out. cacerts_path (HEX_CACERTS_PATH) is documented as the path to the CA certificate store, used instead of the CA bundle that ships with Hex. Hex.HTTP.SSL.ssl_opts/1 passes the configured store as the cacerts option, but builds the partial_chain callback from the bundled store whether cacerts_path is set or not. Hex.HTTP.SSL.partial_chain/2 accepts a server chain when any certificate in it has the same public key as a bundled CA certificate, so a chain that leads to a bundled CA passes verification although the configured store doesn't contain that CA. Hostname verification still applies. This issue affects hex: from 0.20.2 before 2.5.2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00207 10th percentileScored 2026-11-07
Fix Fixed hex (hexpm): 2.5.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
hexpmhex0.20.2 to before 2.5.22.5.2Patch availableCNA
  • hex Vendorhexpm Affected 0.20.2 to before 2.5.2 Fixed in 2.5.2 Patch available CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:hexpm:hex:*:*:*:*:*:*:*:*———
  • cpe:2.3:a:hexpm:hex:*:*:*:*:*:*:*:* Versions — — ·—

Remediation

Upgrade hex to version 2.5.2, which fixes the flaw. The sources list no fixed version for hex.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA hex (hexpm) Fixed in 2.5.2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    hexpm hex 2.5.2

    7 records Highest priority Priority LOW 7 LOW

    Other records, highest priority first

    • TI-2026-71017 Path traversal in Hex via unvalidated dependency app namesPriority LOW 35
    • TI-2026-71021 Hex release-age cooldown is lifted when a locked release is retiredPriority LOW 33
    • TI-2026-71020 Hex mix hex.package fetch writes unverified tarballs to stdoutPriority LOW 30
    Show all 7 records →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-12 Threatist record created from CVE-2026-103503
  2. 2026-10-13 Affected versions changed · Red Hat
  3. 2026-10-13 CVSS score added · Red Hat
  4. 2026-10-13 Priority changed: MEDIUM → LOW
  5. 2026-10-16 CISA SSVC decision points changed

References

Patch 2

Advisory 1

Other 3

  • TI-2026-24685 Lockfile checksums not verified in Hex allows dependency integrity bypass CVSS 4.0HIGH 8.9
  • TI-2026-52887 OAuth token exchange grants repository scopes for organizations the principal cannot access CVSS 4.0HIGH 8.3
  • TI-2026-17414 Password Reset Tokens Do Not Expire CVSS 4.0CRITICAL 9.5
  • TI-2026-59264 Refresh tokens accepted as private repository credentials at the CDN CVSS 4.0LOW 2.3
  • TI-2026-52890 Explicit organization scopes survive token refresh after membership ends CVSS 4.0LOW 2.3
  • TI-2026-17410 Cross-site scripting (XSS) in OAuth Device Authorization screen CVSS 4.0HIGH 8.5
See all 20 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences