« Volver al listado

CVE-2026-9058

Estado: AplazadaCrítica (9.3)—

For untrusted certificates that contain the "Authority Information Access - caIssuers URI" extension, Szafir SDK will automatically download the parent CA certificate from the specified URL and will import it to its trust store as a "nonqualified" certificate. In such a case, Szafir SDK returns a success status code of 0 ("Positively verified") upon successful cryptographic verification and a certificate status of "nonqualified".

For other types of untrusted certificates, Szafir SDK returns a success status code of 0 ("Positively verified") upon successful cryptographic verification and a certificate status of "nondetermined".

Leer descripción completaMostrar menos

This may lead integrating applications to incorrectly treat the digital signature as valid despite an untrusted certificate chain. This flaw enables authentication bypass and user impersonation: (1) in use-cases other than qualified certificate authentication, or (2) if the qualified certificate authentication use-case is not correctly implemented by the integrating application.

This issue was fixed in version 1.8.463.2.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Vulnerabilidad de verificación de certificados en SDK accesible remotamente (AV:N, PR:N) que permite suplantación de identidad y bypass de autenticación mediante certificados no confiables; CWE-295 (improper certificate validation) sustenta impersonación de cuentas.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Vulnerability ScanningPrivileged Account ManagementPassword PoliciesNetwork SegmentationMulti-factor AuthenticationLimit Access to Resource Over Network

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Szafir — SDKAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-9058",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-9058",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-05-26T15:57:55.171237Z"
        }
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "cvd@cert.pl",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 9.3,
          "Automatable": "NOT_DEFINED",
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "NONE",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "HIGH",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "cvd@cert.pl",
      "affectedData": [
        {
          "vendor": "Krajowa Izba Rozliczeniowa",
          "product": "Szafir SDK",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "1.8.463.2",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-05-25T14:16:27.977",
  "references": [
    {
      "url": "https://cert.pl/posts/2026/05/CVE-2026-9058",
      "source": "cvd@cert.pl"
    },
    {
      "url": "https://www.elektronicznypodpis.pl/",
      "source": "cvd@cert.pl"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "cvd@cert.pl",
      "description": [
        {
          "lang": "en",
          "value": "CWE-295"
        },
        {
          "lang": "en",
          "value": "CWE-393"
        },
        {
          "lang": "en",
          "value": "CWE-637"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "For untrusted certificates that contain the \"Authority Information Access - caIssuers URI\" extension, Szafir SDK will automatically download the parent CA certificate from the specified URL and will import it to its trust store as a \"nonqualified\" certificate. In such a case, Szafir SDK returns a success status code of 0 (\"Positively verified\") upon successful cryptographic verification and a certificate status of \"nonqualified\".\n\nFor other types of untrusted certificates, Szafir SDK returns a success status code of 0 (\"Positively verified\") upon successful cryptographic verification and a certificate status of \"nondetermined\".\n\nThis may lead integrating applications to incorrectly treat the digital signature as valid despite an untrusted certificate chain. This flaw enables authentication bypass and user impersonation:\n(1) in use-cases other than qualified certificate authentication, or\n(2) if the qualified certificate authentication use-case is not correctly implemented by the integrating application.\n\nThis issue was fixed in version 1.8.463.2."
    },
    {
      "lang": "es",
      "value": "El SDK de Szafir devuelve un código de estado de éxito del proceso de verificación de firma digital criptográfica (es decir, /VerifyingTaskItem/Signature/VerificationResult/Result/@code == 0, 'Verificado positivamente') incluso cuando el estado de confianza del certificado del firmante no pudo establecerse (es decir, /VerifyingTaskItem/Signature/VerificationResult/SigningCertificate/@certificateType == 'nondetermined'). Esto provoca que las aplicaciones consumidoras traten incorrectamente la firma como válida a pesar de una cadena de certificados no verificada, lo que permite la omisión de autenticación y la suplantación de identidad de usuario.\n\nEste problema se solucionó en la versión 463."
    }
  ],
  "lastModified": "2026-07-23T12:18:52.540",
  "sourceIdentifier": "cvd@cert.pl"
}