CVE-2026-71886

HighCVSS 8.2

Published: 03/10/2026(UTC)Translated: 03/10/2026(UTC)NVD NIST

Summary

In Bouncy Castle for Java before 1.86, the high-level OpenPGP certificate API accepted third-party certifications or trust delegations from any component key of the issuing certificate, without requiring the component to have certification authority. An attacker could use a restricted subkey (e.g., signing-only or encryption-only) to issue a valid identity certification or trust delegation, which was then attributed to the primary key.

Risk Assessment

Organizations using the API for identity verification or trusted introducer decisions may incorrectly attribute an attacker's assertion to the primary key, potentially compromising trust integrity and authorization in OpenPGP-based systems.

Recommendation

Upgrade Bouncy Castle to version 1.86 or later, which requires the component key to hold the CERTIFY_OTHER flag when creating the signature. Review existing implementations for usage of the vulnerable getCertificationBy() and getDelegationBy() methods.

Other vulnerabilities in Bouncy Castle

See all

Original NVD description (English source)

In Bouncy Castle for Java before 1.86, the high-level OpenPGP certificate API accepted a third-party certification or trust delegation from any component key of the issuing certificate, without requiring that component to have been granted the authority to certify. OpenPGPCertificate.getCertificationBy() and getDelegationBy() resolve a third-party signature by matching its issuer key identifier against every key of the third-party certificate, then verify the issuing component's binding chain and the signature itself; nothing checked that the issuing component carried the RFC 9580 sec. 5.2.3.29 certification key flag (CERTIFY_OTHER) when the signature was created. A subkey bound only with SIGN_DATA - the online signing subkey of exactly the offline-primary arrangement those key flags exist to express - could therefore issue a positive User ID certification over an attacker-controlled identity, or a full-trust depth-one direct-key delegation of introducer trust, and the API returned it as a valid signature chain attributed to the third-party certificate. An application treating getCertificationBy(...).isValid() or getDelegationBy(...) as an identity or trusted-introducer decision would attribute the attacker's assertion to the offline primary key. The same held for a legacy RSA subkey bound only for encryption, whose algorithm is nonetheless able to sign. This does not forge the primary key's signature or recover any private key; it promotes an already-compromised restricted subkey to the primary key's identity-issuing authority, defeating the containment the key-flag separation provides. A third-party certification or delegation is now attributed to the issuing certificate only when the component key that made it is the primary key, or is a subkey holding CERTIFY_OTHER when the signature was created, so certification-capable subkeys continue to be accepted; primary keys are accepted whatever their key flags say, since a primary key is certification-capable by construction and certificates carrying no key flags subpacket at all are common. Third-party revocations are deliberately outside the rule, since declining to honour one would keep trust alive rather than withdraw it.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS