GCVE-1988-2026-0339

Vulnerability from gna-1988 – Published: 2026-09-11 07:55 – Updated: 2026-09-11 07:55
VLAI
Title
[NotCVE-2026-0001] Cloudflare Universal SSL CAA augmentation weakens RFC 8657 account binding — CVE-2026-14440 assigned 163 days after public no-CVE disclosure
Summary
---------------------------------------------------------------------------- NotCVE Disclosure Update — NotCVE-2026-0001 / CVE-2026-14440 ---------------------------------------------------------------------------- [-] Summary: On 2026-01-19 the issue described below was published as NotCVE-2026-0001 after no CVE identifier was assigned for it. On 2026-07-01 — 163 days later — Cloudflare assigned CVE-2026-14440 to the same issue, now rated CVSS 9.1. This message documents the disclosure timeline for the public record. [-] Affected: Cloudflare Universal SSL (managed CAA record augmentation) — service-side behaviour; no customer-side patch applicable. [-] Technical Description: Cloudflare Universal SSL automatically adds CAA issue/issuewild records when a customer has Universal SSL enabled and publishes any CAA records for the zone. These auto-added records are not shown in the Cloudflare dashboard but are returned in DNS responses, and can include permissive authorizations such as: CAA 0 issue "letsencrypt.org" CAA 0 issuewild "letsencrypt.org" When a domain owner uses RFC 8657 CAA extensions (accounturi and/or validationmethods) to restrict certificate issuance to a specific authorized ACME account or validation method, the presence of an auto-added CAA issue property WITHOUT those RFC 8657 constraints broadens authorization: per RFC 8657, a CAA property without an accounturi parameter matches any account. This weakens the domain owner's intended account binding and may enable unauthorized DV certificate issuance. [-] Disclosure Timeline: [19/01/2026] - Public record published as NotCVE-2026-0001; no CVE identifier assigned at that time [01/07/2026] - Cloudflare assigns CVE-2026-14440 (CVSS 9.1) for the same issue, 163 days after the public record [-] CVE Reference: CVE-2026-14440 [-] References: https://notcve.org/notcve/NotCVE-2026-0001 (full technical record, preserved since day one) https://notcve.org/cve/CVE-2026-14440 [-] About NotCVE: NotCVE (https://notcve.org) assigns public, timestamped NotCVE IDs to vulnerabilities not acknowledged by vendors. Vendor will not assign a CVE? Request a NotCVE: https://notcve.org/form/ · Contributors: https://notcve.org/hall/ _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
VULNARCHIVE GNA GNA-1988
GNA scorecard E 38/100 over 445 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
Cloudflare Universal Ssl Affected: unknown
guessed Create a notification for this product.
Credits
NotCVE Advisories
Relationships
reference GCVE-1988-2026-0339 (this record)
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Universal Ssl",
          "vendor": "Cloudflare",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "NotCVE Advisories"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "----------------------------------------------------------------------------\nNotCVE Disclosure Update \u2014 NotCVE-2026-0001 / CVE-2026-14440\n----------------------------------------------------------------------------\n\n[-] Summary:\n\nOn 2026-01-19 the issue described below was published as NotCVE-2026-0001\nafter no CVE identifier was assigned for it. On 2026-07-01 \u2014 163 days\nlater \u2014 Cloudflare assigned CVE-2026-14440 to the same issue, now rated\nCVSS 9.1. This message documents the disclosure timeline for the public\nrecord.\n\n[-] Affected:\n\nCloudflare Universal SSL (managed CAA record augmentation) \u2014 service-side\nbehaviour; no customer-side patch applicable.\n\n[-] Technical Description:\n\nCloudflare Universal SSL automatically adds CAA issue/issuewild records\nwhen a customer has Universal SSL enabled and publishes any CAA records\nfor the zone. These auto-added records are not shown in the Cloudflare\ndashboard but are returned in DNS responses, and can include permissive\nauthorizations such as:\n\n    CAA 0 issue \"letsencrypt.org\"\n    CAA 0 issuewild \"letsencrypt.org\"\n\nWhen a domain owner uses RFC 8657 CAA extensions (accounturi and/or\nvalidationmethods) to restrict certificate issuance to a specific\nauthorized ACME account or validation method, the presence of an\nauto-added CAA issue property WITHOUT those RFC 8657 constraints broadens\nauthorization: per RFC 8657, a CAA property without an accounturi\nparameter matches any account. This weakens the domain owner\u0027s intended\naccount binding and may enable unauthorized DV certificate issuance.\n\n[-] Disclosure Timeline:\n\n[19/01/2026] - Public record published as NotCVE-2026-0001; no CVE\n               identifier assigned at that time\n[01/07/2026] - Cloudflare assigns CVE-2026-14440 (CVSS 9.1) for the same\n               issue, 163 days after the public record\n\n[-] CVE Reference:\n\nCVE-2026-14440\n\n[-] References:\n\nhttps://notcve.org/notcve/NotCVE-2026-0001   (full technical record,\n                                              preserved since day one)\nhttps://notcve.org/cve/CVE-2026-14440\n\n[-] About NotCVE:\n\nNotCVE (https://notcve.org) assigns public, timestamped NotCVE IDs to\nvulnerabilities not acknowledged by vendors. Vendor will not assign a CVE?\nRequest a NotCVE: https://notcve.org/form/ \u00b7 Contributors:\nhttps://notcve.org/hall/\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T07:55:56Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jul/22"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jul/22"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://notcve.org"
        },
        {
          "url": "https://notcve.org/cve/CVE-2026-14440"
        },
        {
          "url": "https://notcve.org/form/"
        },
        {
          "url": "https://notcve.org/hall/"
        },
        {
          "url": "https://notcve.org/notcve/NotCVE-2026-0001"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jul/22"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[NotCVE-2026-0001] Cloudflare Universal SSL CAA augmentation weakens RFC 8657 account binding \u2014 CVE-2026-14440 assigned 163 days after public no-CVE disclosure",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-14440",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0339",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jul/22",
            "automated": true,
            "contentSha256": "74c32742b1845f9d69c269583c1496d4b7bcc719376171964a308397dc9fea62",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jul/22",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-07-13T13:10:43Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0339"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-11T07:55:56Z",
    "dateUpdated": "2026-09-11T07:55:56Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0339"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.