CVE-2026-42784

sequoia-openpgp, a widely used Rust implementation of OpenPGP, incorrectly infers key capabilities for older certificates that lack a key flags subpacket, creating a discrepancy between the key flags a verifier assumes and what the certificate actually declares. An attacker who controls such a legacy-style certificate can leverage this confusion to bypass the back-signature check, which normally proves that a primary key authorized a signing subkey. As a result, an attacker can bind an arbitrary subkey to their own certificate and produce signatures that verifiers accept as legitimate, compromising the cryptographic integrity of signature verification. Any software or service that uses sequoia-openpgp to verify attacker-supplied OpenPGP certificates and signatures is affected, including downstream tooling such as RPM package signature verification in RPM-based Linux distributions. No public proof-of-concept is known, the issue is not in CISA's KEV catalog, and no in-the-wild exploitation has been reported.

What to do: Track the Sequoia PGP security advisory (CVE-2026-42784) and upgrade sequoia-openpgp to the patched release as soon as one is published; RPM-based distribution users should apply package-manager security updates as vendors ship rebuilt components. Until patched, exercise caution when verifying certificates that lack a key flags subpacket, and treat subkey-binding and back-signature validation results from unpatched sequoia-openpgp versions as untrusted. Audit your dependency tree (cargo) to determine whether sequoia-openpgp is present in verification-critical paths.