CVE-2026-42784: Red Hat Confidential Compute Attestation

High severity, CVSS 7.4. EPSS: 0.3% chance of exploitation in the next 30 days.

A flaw was found in sequoia-openpgp. The library incorrectly infers key flags for older certificates when a key flags subpacket is missing, leading to a discrepancy in how key capabilities are viewed. This key flag confusion allows an attacker to bypass the back-signature check. Consequently, an attacker can illegitimately bind an arbitrary subkey to their own certificate and forge signatures, completely compromising cryptographic integrity.

Affected products

• Red Hat Confidential Compute Attestation
• Red Hat Red Hat Ansible Automation Platform 2
• Red Hat Red Hat Ansible Automation Platform 2.6 For Rhel 9: before 0:0.1.34-1.el9ap (fixed in 0:0.1.34-1.el9ap)
• Red Hat Red Hat Cost Management On-Premise 1: before 1791460851 (fixed in 1791460851)
• Red Hat Red Hat Enterprise Linux 10: before 0:1.10.2.1-1.el10_2 (fixed in 0:1.10.2.1-1.el10_2); before 0:1.3.0.2-1.el10_2 (fixed in 0:1.3.0.2-1.el10_2); before 0:1.4.0.1-2.el10_2 (fixed in 0:1.4.0.1-2.el10_2)
• Red Hat Red Hat Enterprise Linux 9: before 0:1.10.2.1-1.el9_8 (fixed in 0:1.10.2.1-1.el9_8)
• Red Hat Red Hat Hardened Images: before 0.3.2-4.hum1 (fixed in 0.3.2-4.hum1)
• Red Hat Red Hat Openshift Container Platform 4
• Red Hat Red Hat Satellite 6
• Red Hat Red Hat Trusted Profile Analyzer

Published 2026-09-16. Last modified 2026-10-09.