GCVE-1988-2026-0339
Vulnerability from gna-1988 – Published: 2026-09-11 07:55 – Updated: 2026-09-11 07:55
VLAI
EPSS
VEX
Title
[NotCVE-2026-0001] Cloudflare Universal SSL CAA augmentation weakens RFC 8657 account binding — CVE-2026-14440 assigned 163 days after public no-CVE disclosure
Summary
----------------------------------------------------------------------------
NotCVE Disclosure Update — NotCVE-2026-0001 / CVE-2026-14440
----------------------------------------------------------------------------
[-] Summary:
On 2026-01-19 the issue described below was published as NotCVE-2026-0001
after no CVE identifier was assigned for it. On 2026-07-01 — 163 days
later — Cloudflare assigned CVE-2026-14440 to the same issue, now rated
CVSS 9.1. This message documents the disclosure timeline for the public
record.
[-] Affected:
Cloudflare Universal SSL (managed CAA record augmentation) — service-side
behaviour; no customer-side patch applicable.
[-] Technical Description:
Cloudflare Universal SSL automatically adds CAA issue/issuewild records
when a customer has Universal SSL enabled and publishes any CAA records
for the zone. These auto-added records are not shown in the Cloudflare
dashboard but are returned in DNS responses, and can include permissive
authorizations such as:
CAA 0 issue "letsencrypt.org"
CAA 0 issuewild "letsencrypt.org"
When a domain owner uses RFC 8657 CAA extensions (accounturi and/or
validationmethods) to restrict certificate issuance to a specific
authorized ACME account or validation method, the presence of an
auto-added CAA issue property WITHOUT those RFC 8657 constraints broadens
authorization: per RFC 8657, a CAA property without an accounturi
parameter matches any account. This weakens the domain owner's intended
account binding and may enable unauthorized DV certificate issuance.
[-] Disclosure Timeline:
[19/01/2026] - Public record published as NotCVE-2026-0001; no CVE
identifier assigned at that time
[01/07/2026] - Cloudflare assigns CVE-2026-14440 (CVSS 9.1) for the same
issue, 163 days after the public record
[-] CVE Reference:
CVE-2026-14440
[-] References:
https://notcve.org/notcve/NotCVE-2026-0001 (full technical record,
preserved since day one)
https://notcve.org/cve/CVE-2026-14440
[-] About NotCVE:
NotCVE (https://notcve.org) assigns public, timestamped NotCVE IDs to
vulnerabilities not acknowledged by vendors. Vendor will not assign a CVE?
Request a NotCVE: https://notcve.org/form/ · Contributors:
https://notcve.org/hall/
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
9 references
Impacted products
1 product
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Cloudflare | Universal Ssl |
Affected:
unknown
|
guessed |
Relationships
reference
GCVE-1988-2026-0339 (this record)
- related CVE-2026-14440
{
"containers": {
"cna": {
"affected": [
{
"product": "Universal Ssl",
"vendor": "Cloudflare",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "NotCVE Advisories"
}
],
"descriptions": [
{
"lang": "en",
"value": "----------------------------------------------------------------------------\nNotCVE Disclosure Update \u2014 NotCVE-2026-0001 / CVE-2026-14440\n----------------------------------------------------------------------------\n\n[-] Summary:\n\nOn 2026-01-19 the issue described below was published as NotCVE-2026-0001\nafter no CVE identifier was assigned for it. On 2026-07-01 \u2014 163 days\nlater \u2014 Cloudflare assigned CVE-2026-14440 to the same issue, now rated\nCVSS 9.1. This message documents the disclosure timeline for the public\nrecord.\n\n[-] Affected:\n\nCloudflare Universal SSL (managed CAA record augmentation) \u2014 service-side\nbehaviour; no customer-side patch applicable.\n\n[-] Technical Description:\n\nCloudflare Universal SSL automatically adds CAA issue/issuewild records\nwhen a customer has Universal SSL enabled and publishes any CAA records\nfor the zone. These auto-added records are not shown in the Cloudflare\ndashboard but are returned in DNS responses, and can include permissive\nauthorizations such as:\n\n CAA 0 issue \"letsencrypt.org\"\n CAA 0 issuewild \"letsencrypt.org\"\n\nWhen a domain owner uses RFC 8657 CAA extensions (accounturi and/or\nvalidationmethods) to restrict certificate issuance to a specific\nauthorized ACME account or validation method, the presence of an\nauto-added CAA issue property WITHOUT those RFC 8657 constraints broadens\nauthorization: per RFC 8657, a CAA property without an accounturi\nparameter matches any account. This weakens the domain owner\u0027s intended\naccount binding and may enable unauthorized DV certificate issuance.\n\n[-] Disclosure Timeline:\n\n[19/01/2026] - Public record published as NotCVE-2026-0001; no CVE\n identifier assigned at that time\n[01/07/2026] - Cloudflare assigns CVE-2026-14440 (CVSS 9.1) for the same\n issue, 163 days after the public record\n\n[-] CVE Reference:\n\nCVE-2026-14440\n\n[-] References:\n\nhttps://notcve.org/notcve/NotCVE-2026-0001 (full technical record,\n preserved since day one)\nhttps://notcve.org/cve/CVE-2026-14440\n\n[-] About NotCVE:\n\nNotCVE (https://notcve.org) assigns public, timestamped NotCVE IDs to\nvulnerabilities not acknowledged by vendors. Vendor will not assign a CVE?\nRequest a NotCVE: https://notcve.org/form/ \u00b7 Contributors:\nhttps://notcve.org/hall/\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T07:55:56Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jul/22"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Jul/22"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://notcve.org"
},
{
"url": "https://notcve.org/cve/CVE-2026-14440"
},
{
"url": "https://notcve.org/form/"
},
{
"url": "https://notcve.org/hall/"
},
{
"url": "https://notcve.org/notcve/NotCVE-2026-0001"
},
{
"url": "https://seclists.org/fulldisclosure/"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Jul/22"
],
"discovery": "EXTERNAL"
},
"title": "[NotCVE-2026-0001] Cloudflare Universal SSL CAA augmentation weakens RFC 8657 account binding \u2014 CVE-2026-14440 assigned 163 days after public no-CVE disclosure",
"x_gcve": [
{
"recordType": "reference",
"relationships": [
{
"destId": "CVE-2026-14440",
"type": "related"
}
],
"vulnId": "GCVE-1988-2026-0339",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jul/22",
"automated": true,
"contentSha256": "74c32742b1845f9d69c269583c1496d4b7bcc719376171964a308397dc9fea62",
"evidenceScore": 7,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Jul/22",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-07-13T13:10:43Z"
}
},
{
"recordType": "advisory",
"vulnId": "gcve-1988-2026-0339"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-11T07:55:56Z",
"dateUpdated": "2026-09-11T07:55:56Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0339"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…