CVE-2026-93602: 
Samba vulnerability analysis and mitigation

CVE-2026-93602 is a Certificate Revocation Check Bypass vulnerability in rustls-webpki, a Rust library for WebPKI certificate validation. The flaw stems from faulty CRL authority-matching logic that only evaluates the first distributionPoint of a certificate against each CRL's IssuingDistributionPoint, silently ignoring any additional distribution points. Affected versions include rustls-webpki >= 0.102.0-alpha.0 and < 0.103.10, and >= 0.104.0-alpha.1 and < 0.104.0-alpha.5. The vulnerability was published on September 18, 2026, with patches released the same day. It carries a CVSS v3.1 score of 4.4 (Medium) and a CVSS v4.0 score of 5.9 (Medium) (GitHub Advisory, Github Advisory DB).

The root cause is classified under CWE-299 (Improper Check for Certificate Revocation) and CWE-295 (Improper Certificate Validation). When a certificate contains multiple distributionPoint entries in its CRL Distribution Points extension, the library's matching logic only compares the first entry against the CRL's IssuingDistributionPoint; subsequent entries are never evaluated. This means that a valid CRL covering a revoked certificate may not be recognized as authoritative, causing the revocation check to fail silently. Under UnknownStatusPolicy::Allow, this results in revoked certificates being accepted as valid; under the default UnknownStatusPolicy::Deny, it produces an incorrect Error::UnknownRevocationStatus rather than a proper revocation error. Exploitation requires the attacker to control or have compromised a trusted Certificate Authority, as both the certificate and CRL must be signed by a trusted issuer (GitHub Advisory, Github Advisory DB).

The primary impact is an integrity violation: revoked certificates can be accepted as valid by applications using rustls-webpki with UnknownStatusPolicy::Allow, enabling authentication bypass with compromised credentials. Under the default deny policy, the bug causes incorrect validation errors rather than outright acceptance, which is considered a safer but still incorrect behavior. There is no confidentiality or availability impact. The practical risk is that an attacker who has already compromised a trusted CA — or who holds a revoked credential — could continue to authenticate to services relying on this library for certificate validation (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date (Github Advisory DB). The EPSS score is approximately 0.20%, indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires high privileges — specifically, the ability to compromise a trusted Certificate Authority — making opportunistic exploitation unlikely. The NVD SSVC assessment also classifies exploitation as "none" at this time (Github Advisory DB).

1. Prerequisite — Compromise a Trusted CA: The attacker must first compromise or control a Certificate Authority that is trusted by the target system using rustls-webpki. This is a significant barrier and is the primary precondition for exploitation.
2. Obtain or Identify a Revoked Certificate: Using the compromised CA, identify or issue a certificate that has been (or should be) revoked, and ensure it contains multiple distributionPoint entries in its CRL Distribution Points extension.
3. Craft a CRL with Mismatched Distribution Points: Publish a CRL whose IssuingDistributionPoint matches only the second (or later) distributionPoint of the target certificate — not the first. Because rustls-webpki only checks the first entry, the CRL will not be recognized as authoritative for that certificate.
4. Present the Revoked Certificate: Use the revoked certificate to authenticate to a service or system that relies on rustls-webpki for certificate validation with UnknownStatusPolicy::Allow configured.
5. Bypass Revocation Check: The library fails to match the CRL to the certificate's distribution points beyond the first, treats the revocation status as unknown, and — under Allow policy — accepts the revoked certificate as valid, granting the attacker authenticated access (GitHub Advisory).

Update rustls-webpki to version 0.103.10 (for the 0.103.x branch) or 0.104.0-alpha.5 (for the 0.104.x alpha branch) to receive the fix. No configuration-based workaround fully mitigates the issue, but applications using the default UnknownStatusPolicy::Deny are not at risk of accepting revoked certificates (though they may experience incorrect validation errors). Organizations should also review and harden controls over trusted Certificate Authorities to reduce the risk of CA compromise, which is the primary precondition for exploitation. Audit any dependent applications to confirm their UnknownStatusPolicy configuration (GitHub Advisory, Red Hat Bugzilla).

Red Hat tracked the vulnerability via their Bugzilla system and assigned it medium severity, with a broad CC list indicating review across multiple product teams (Red Hat Bugzilla). OpenSUSE issued a security announcement addressing the vulnerability in their package ecosystem (OpenSUSE Advisory). Microsoft also published an advisory entry for the CVE. The rustls project maintainers characterized the vulnerability as "of limited impact" given the high bar for exploitation, noting that a CA-level attacker would likely have more impactful means of bypassing revocation (GitHub Advisory).