CVE-2026-78323: 
Linux Red Hat vulnerability analysis and mitigation

CVE-2026-78323 is an improper certificate validation vulnerability in JSS (Java Security Services) affecting the JSSTrustManager class. The flaw allows certificates present in the NSS database without TRUSTED_CA flags to be accepted as trust anchors for TLS connections, enabling man-in-the-middle attacks in non-default configurations where certificate revocation checking is disabled. It was discovered by Marco Fargetta (Red Hat) and publicly disclosed on August 24, 2026. Affected products include Red Hat JSS (as shipped in redhat-pki:10/jss and related packages) and Red Hat Certificate System. It carries a CVSS v3.1 base score of 6.5 (Medium/High) (Red Hat CVE, GitHub Advisory).

The root cause is classified as CWE-295 (Improper Certificate Validation). The JSSTrustManager class, which implements javax.net.ssl.X509TrustManager for JSS-based TLS connections, does not filter CA certificates by NSS trust flags when building its accepted issuers set. Specifically, getAcceptedIssuers() returns all certificates with basicConstraints CA=TRUE from the NSS database regardless of whether they carry TRUSTED_CA trust flags, and checkSignature() performs only cryptographic signature validation against this unfiltered set. As a result, a certificate with only VALID_CA flags — as may be set by routine operations such as certificate enrollment via CERT_ImportCAChainTrusted — can be treated as a trust anchor. Exploitation requires an attacker to control the private key of such an under-trusted CA and requires the target to have certificate revocation checking disabled (a non-default configuration). The server-side TLS path (TomcatJSS) uses JSSNativeTrustManager, which properly delegates to NSS native verification and is not affected (Red Hat CVE, Red Hat Bugzilla).

Successful exploitation enables a man-in-the-middle attacker to forge TLS certificates that are accepted by PKI client connections, allowing interception and potential decryption of encrypted communications. The primary impact is high confidentiality loss (exposure of sensitive data in transit) and low integrity impact (ability to inject or modify data in intercepted sessions); availability is not affected. Exploitation is constrained to outbound PKI client connections using JSSTrustManager in non-default configurations where revocation checking has been explicitly disabled (Red Hat CVE, GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date. The EPSS score is 0.0, and NVD SSVC assessment indicates exploitation is "none" and the vulnerability is not automatable. The attack complexity is rated High, as exploitation requires the attacker to control the private key of a CA certificate present in the target's NSS database without TRUSTED_CA flags, and the target must have revocation checking disabled. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (Red Hat CVE, GitHub Advisory).

The primary mitigation is to ensure certificate revocation verification remains enabled in JSS configurations — specifically, do not set isCertRevocationVerify to false. In default configurations, the native revocation verification check (certChainRevokeVerify) is enabled and mitigates this flaw. A patch is available; users should update to a patched version of JSS as provided by Red Hat. Server-side TLS configurations using TomcatJSS with JSSNativeTrustManager are not affected and require no changes. Review PKI client connection settings to confirm revocation checking is active and monitor for unexpected CA certificates in the NSS database (Red Hat CVE, Red Hat Bugzilla).

Red Hat, as the CNA and discoverer of this vulnerability (via internal researcher Marco Fargetta), published a detailed advisory noting that the flaw is mitigated in default product configurations and that exploitation requires non-default, undocumented configuration changes. No notable independent researcher commentary or significant social media discussion has been observed beyond standard CVE aggregator coverage (Red Hat CVE).