CVE-2026-40944: 
vulnerability analysis and mitigation

CVE-2026-40944 is an improper certificate validation vulnerability in Oxia, an open-source metadata store and coordination system. The flaw exists in versions up to and including 0.16.1, where the trustedCertPool() function in the TLS configuration only parses the first PEM block from CA certificate bundle files, silently discarding any additional certificates. This breaks mutual TLS (mTLS) certificate chain validation when CA bundles contain multiple certificates (e.g., intermediate + root CA). The vulnerability was published on April 21, 2026, and fixed in version 0.16.2. It carries a CVSS v4.0 base score of 6.9 (Medium) (GitHub Advisory).

The root cause is classified as CWE-295 (Improper Certificate Validation). In common/security/tls.go, the trustedCertPool() method calls pem.Decode() only once, processing a single PEM block and silently discarding the remaining bytes that may contain additional certificates in a chain. Furthermore, the error return from pem.Decode() is ignored, meaning a corrupted CA file results in an empty certificate pool with no error surfaced to the operator. This network-accessible flaw requires no privileges or user interaction to trigger, as any client presenting a certificate signed by an intermediate CA (not directly by the single loaded root) will be rejected (GitHub Advisory).

The primary impact is a degradation of the mTLS security posture in affected Oxia deployments. Legitimate clients with properly chained certificates are rejected with x509: certificate signed by unknown authority errors, rendering mTLS non-functional with standard CA chain configurations. This may pressure operators into disabling client certificate verification entirely, which would expose the coordination system to unauthorized access. All deployments using TLS with the trustedCaFile configuration option containing multi-certificate bundles are affected (GitHub Advisory).

There is no evidence of in-the-wild exploitation or publicly available exploit code for this vulnerability. The EPSS score is approximately 0.023%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The attack vector is network-based with no authentication or user interaction required, but exploitation is indirect — an attacker benefits from the broken mTLS validation only if operators are forced to weaken their TLS configuration as a result (GitHub Advisory).

The vulnerability is fixed in Oxia version 0.16.2, which iterates over all PEM blocks in the CA file, parses each CERTIFICATE block, and returns an error if no valid certificates are found. Operators should upgrade to 0.16.2 as the primary remediation. As a temporary workaround for those unable to upgrade immediately, use CA files containing only a single certificate — specifically the direct issuer of client certificates rather than a full chain bundle — to avoid the incomplete parsing behavior (GitHub Advisory).

The advisory was published by Oxia maintainer merlimat on GitHub on April 13, 2026, and assigned a "High" severity rating by the project. No significant broader media coverage or notable researcher commentary beyond the official advisory has been identified for this vulnerability.