CVE-2026-14440
Cloudflare Universal SSL automatically managed CAA RRset supersedes customer-configured CAA records
Description
Description: To issue and renew TLS certificates on behalf of customers, Cloudflare's Universal SSL feature automatically manages the CAA RRset for the customer's zone. This auto-managed RRset is permissive by design (e.g. 'issue "letsencrypt.org"' without parameters). On Universal SSL zones, Cloudflare's authoritative DNS serves this auto-managed RRset at query time, superseding any customer-configured CAA records on the zone. When a customer publishes a stricter CAA record using the RFC 8657 accounturi or validationmethods parameters, the Certificate Authority does not observe those parameters when evaluating the served RRset under RFC 8659. As a result, the RFC 8657 account-binding and validation-method-binding protections are not enforced end-to-end on Universal SSL zones. Successful exploitation could result in issuance of a browser-trusted TLS certificate to an attacker, enabling MITM against the affected domain. Exploitation is non-trivial in practice: an attacker would need to hold an ACME account at one of the Certificate Authorities in the served CAA RRset and to simultaneously satisfy domain control validation across the multiple geographically distinct Network Perspectives the CA relies on for Multi-Perspective Issuance Corroboration. Cloudflare prefixes are anycast-announced from hundreds of locations globally, raising the bar against single-vantage-point BGP hijacks. Any resulting misissuance of a browser-trusted certificate is subject to Certificate Transparency logging required by major browsers, and would be visible to CT monitoring. Mitigation: Customers requiring strict RFC 8657 enforcement need to disable Universal SSL on the affected zone. Universal SSL's automatic CAA management and customer-set RFC 8657 accounturi and validationmethods enforcement are mutually exclusive by the nature of the issue, so there is no in-product workaround that preserves both. Certificate Transparency monitoring is recommended for all customers as a general detection control. Credits: David Osipov (ORCID: https://orcid.org/0009-0005-2713-9242), independent researcher
INFO
Published Date :
July 1, 2026, 11:16 p.m.
Last Modified :
Oct. 25, 2026, 9:10 p.m.
Remotely Exploit :
No
Source :
[email protected]
Affected Products
The following products are affected by CVE-2026-14440
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
No affected product recoded yet
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | MEDIUM | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | ||||
| CVSS 4.0 | HIGH | a22f1246-ba21-4bb4-a601-ad51614c1513 | ||||
| CVSS 4.0 | HIGH | [email protected] |
Solution
- Disable Universal SSL on affected zones.
- Enable Certificate Transparency monitoring.
- Review CAA record configurations.
Public PoC/Exploit Available at Github
CVE-2026-14440 has a 1 public
PoC/Exploit available at Github.
Go to the Public Exploits tab to see the list.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-14440.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-14440 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-14440
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
My personal repository
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-14440 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-14440 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 25, 2026
Action Type Old Value New Value Added Translation Title: Universal SSL de Cloudflare, Description: Descripción: Para emitir y renovar certificados TLS en nombre de los clientes, la función Universal SSL de Cloudflare gestiona automáticamente el RRset CAA para la zona del cliente. Este RRset autogestionado es permisivo por diseño (p. ej., ’issue “letsencrypt.org”’ sin parámetros). En las zonas Universal SSL, el DNS autoritativo de Cloudflare sirve este RRset autogestionado en el momento de la consulta, anulando cualquier registro CAA configurado por el cliente en la zona. Cuando un cliente publica un registro CAA más estricto utilizando los parámetros accounturi o validationmethods de RFC 8657, la Autoridad de Certificación no observa esos parámetros al evaluar el RRset servido bajo RFC 8659. Como resultado, las protecciones de enlace de cuenta y de enlace de método de validación de RFC 8657 no se aplican de extremo a extremo en las zonas Universal SSL. Una explotación exitosa podría resultar en la emisión de un certificado TLS de confianza para el navegador a un atacante, permitiendo MitM contra el dominio afectado. La explotación no es trivial en la práctica: un atacante necesitaría tener una cuenta ACME en una de las Autoridades de Certificación en el RRset CAA servido y satisfacer simultáneamente la validación de control de dominio a través de las múltiples Perspectivas de Red geográficamente distintas en las que la CA confía para la Corroboración de Emisión Multi-Perspectiva. Los prefijos de Cloudflare se anuncian por anycast desde cientos de ubicaciones a nivel mundial, elevando el listón contra los secuestros BGP de un solo punto de vista. Cualquier emisión incorrecta resultante de un certificado de confianza para el navegador está sujeta al registro de Transparencia de Certificados requerido por los principales navegadores, y sería visible para la monitorización de CT. Mitigación: Los clientes que requieren una aplicación estricta de RFC 8657 necesitan deshabilitar Universal SSL en la zona afectada. La gestión automática de CAA de Universal SSL y la aplicación de los parámetros accounturi y validationmethods de RFC 8657 configurados por el cliente son mutuamente excluyentes por la naturaleza del problema, por lo que no hay una solución alternativa en el producto que preserve ambos. Se recomienda la monitorización de Transparencia de Certificados para todos los clientes como un control de detección general. Créditos: David Osipov (ORCID: https://orcid.org/0009-0005-2713-9242), investigador independiente -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jul. 02, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N Added CWE CWE-693 Removed CWE CWE-358 Added Reference https://community.cloudflare.com/t/critical-security-gap-cloudflare-must-fully-support-rfc-8657-caa/799999/10 Added Reference https://community.cloudflare.com/t/universal-ssl-exposes-domains-to-bgp-leaks-re-venezuela-analysis/879930 Added Reference https://david-osipov.vision/en/blog/cybersecurity/cloudflare-ssl-mitm-flaw-2026/ Added Reference https://zenodo.org/records/18330221 Changed SSVC {'id': 'CVE-2026-14440', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'no'}, {'technicalImpact': 'total'}], 'version': '2.0.3', 'timestamp': '2026-07-02T13:13:19.631392Z'} {'id': 'CVE-2026-14440', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'poc'}, {'automatable': 'no'}, {'technicalImpact': 'total'}], 'version': '2.0.3', 'timestamp': '2026-07-02T19:22:08.681269Z'} -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jul. 02, 2026
Action Type Old Value New Value Added CWE CWE-358 Added SSVC {'id': 'CVE-2026-14440', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'no'}, {'technicalImpact': 'total'}], 'version': '2.0.3', 'timestamp': '2026-07-02T13:13:19.631392Z'} -
New CVE Received by [email protected]
Jul. 01, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'Cloudflare', 'product': 'Universal SSL', 'versions': [{'status': 'affected', 'version': '0', 'versionType': 'custom', 'lessThanOrEqual': 'current'}], 'platforms': ['Cloud Service'], 'defaultStatus': 'unaffected'}] Added Description Description: To issue and renew TLS certificates on behalf of customers, Cloudflare's Universal SSL feature automatically manages the CAA RRset for the customer's zone. This auto-managed RRset is permissive by design (e.g. 'issue "letsencrypt.org"' without parameters). On Universal SSL zones, Cloudflare's authoritative DNS serves this auto-managed RRset at query time, superseding any customer-configured CAA records on the zone. When a customer publishes a stricter CAA record using the RFC 8657 accounturi or validationmethods parameters, the Certificate Authority does not observe those parameters when evaluating the served RRset under RFC 8659. As a result, the RFC 8657 account-binding and validation-method-binding protections are not enforced end-to-end on Universal SSL zones. Successful exploitation could result in issuance of a browser-trusted TLS certificate to an attacker, enabling MITM against the affected domain. Exploitation is non-trivial in practice: an attacker would need to hold an ACME account at one of the Certificate Authorities in the served CAA RRset and to simultaneously satisfy domain control validation across the multiple geographically distinct Network Perspectives the CA relies on for Multi-Perspective Issuance Corroboration. Cloudflare prefixes are anycast-announced from hundreds of locations globally, raising the bar against single-vantage-point BGP hijacks. Any resulting misissuance of a browser-trusted certificate is subject to Certificate Transparency logging required by major browsers, and would be visible to CT monitoring. Mitigation: Customers requiring strict RFC 8657 enforcement need to disable Universal SSL on the affected zone. Universal SSL's automatic CAA management and customer-set RFC 8657 accounturi and validationmethods enforcement are mutually exclusive by the nature of the issue, so there is no in-product workaround that preserves both. Certificate Transparency monitoring is recommended for all customers as a general detection control. Credits: David Osipov (ORCID: https://orcid.org/0009-0005-2713-9242), independent researcher Added CVSS V4.0 AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Added Reference https://developers.cloudflare.com/ssl/edge-certificates/caa-records/ Added Reference https://developers.cloudflare.com/ssl/edge-certificates/universal-ssl/limitations/ Added Reference https://www.rfc-editor.org/rfc/rfc8657 Added Reference https://www.rfc-editor.org/rfc/rfc8659