Critical CVE-2026-42784 Vulnerability in sequoia-openpgp

• •CVE-2026-42784 allows signature forgery via key flag confusion.
• •Red Hat products using sequoia-openpgp are at risk of cryptographic integrity compromise.
• •No effective workaround is available; urgent remediation is required.

A critical vulnerability (CVE-2026-42784) was discovered in the sequoia-openpgp library, affecting its ability to correctly infer key flags for older certificates. This flaw allows attackers to bypass back-signature checks, enabling them to bind arbitrary subkeys to their own certificates and forge signatures. The potential impact includes a complete compromise of cryptographic integrity, affecting Red Hat products using sequoia-openpgp. Exploitation could lead to unauthorized actions, data manipulation, and undermined trust in automated systems. Mitigation options are currently limited, and organizations relying on automated build and deployment pipelines are particularly at risk. The CVE was published on September 16, 2026, and no effective workaround has been confirmed. Immediate action is advised for those affected.