A flaw was found in sequoia-openpgp. The library incorrectly infers key flags for older certificates when a key flags subpacket is missing, leading to a discrepancy in how key capabilities are viewed. This key flag confusion allows an attacker to bypass the back-signature check. Consequently, an attacker can illegitimately bind an arbitrary subkey to their own certificate and forge signatures, completely compromising cryptographic integrity.

oracle_linux ELSA-2026-76733: ELSA-2026-76733:  rust-rpm-sequoia security update (IMPORTANT)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:76733 advisory.

    * sequoia-openpgp: sequoia-openpgp: Cryptographic integrity compromise via key flag confusion     (CVE-2026-42784)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:76734 advisory.

    * sequoia-openpgp: sequoia-openpgp: Cryptographic integrity compromise via key flag confusion     (CVE-2026-42784)


    Bug Fix(es) and Enhancement(s):

      * Uninformative error message on --import failure [almalinux-10.2.z] (JIRA:AlmaLinux-176906)
      * Return NotTrusted importing non-allowed keys [almalinux-10.2.z] (JIRA:AlmaLinux-176907)
      * [FTBFS] Update bindgen for LLVM 22 compatibility [almalinux-10.2.z] (JIRA:AlmaLinux-176908)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2026:76735 advisory.

    * sequoia-openpgp: sequoia-openpgp: Cryptographic integrity compromise via key flag confusion     (CVE-2026-42784)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:76737 advisory.

    * sequoia-openpgp: sequoia-openpgp: Cryptographic integrity compromise via key flag confusion     (CVE-2026-42784)

    Bug Fix(es) and Enhancement(s):

    * Unbundle capnproto from sequoia-sq [rhel-10.2.z] (JIRA:Rocky Linux-177547)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:76737 advisory.

    Command-line frontends for Sequoia.

    Security Fix(es):

    * sequoia-openpgp: sequoia-openpgp: Cryptographic integrity compromise via key flag confusion     (CVE-2026-42784)

    Bug Fix(es) and Enhancement(s):

    * Unbundle capnproto from sequoia-sq [rhel-10.2.z] (JIRA:RHEL-177547)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:76734 advisory.

    * sequoia-openpgp: sequoia-openpgp: Cryptographic integrity compromise via key flag confusion     (CVE-2026-42784)

    Bug Fix(es) and Enhancement(s):

    * Uninformative error message on --import failure [rhel-10.2.z] (JIRA:Rocky Linux-176906)

    * Return NotTrusted importing non-allowed keys [rhel-10.2.z] (JIRA:Rocky Linux-176907)

    * [FTBFS] Update bindgen for LLVM 22 compatibility [rhel-10.2.z] (JIRA:Rocky Linux-176908)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:76735 advisory.

    * sequoia-openpgp: sequoia-openpgp: Cryptographic integrity compromise via key flag confusion     (CVE-2026-42784)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:76733 advisory.

    * sequoia-openpgp: sequoia-openpgp: Cryptographic integrity compromise via key flag confusion     (CVE-2026-42784)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-76735 advisory.

    [1.3.0.2-1]
    - Update openpgp crate to fix CVE-2026-42784

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-76734 advisory.

    [1.10.2.1-1]
    - Rebase to 1.10.2 and sequioa-openpgp with fixes for CVE-2026-42784

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:76735 advisory.

    A simple OpenPGP signature verification program.

    Security Fix(es):

    * sequoia-openpgp: sequoia-openpgp: Cryptographic integrity compromise via key flag confusion     (CVE-2026-42784)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:76734 advisory.

    An implementation of the RPM PGP interface using Sequoia.

    Security Fix(es):

    * sequoia-openpgp: sequoia-openpgp: Cryptographic integrity compromise via key flag confusion     (CVE-2026-42784)

    Bug Fix(es) and Enhancement(s):

    * Uninformative error message on --import failure [rhel-10.2.z] (JIRA:RHEL-176906)

    * Return NotTrusted importing non-allowed keys [rhel-10.2.z] (JIRA:RHEL-176907)

    * [FTBFS] Update bindgen for LLVM 22 compatibility [rhel-10.2.z] (JIRA:RHEL-176908)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:76733 advisory.

    An implementation of the RPM PGP interface using Sequoia.

    Security Fix(es):

    * sequoia-openpgp: sequoia-openpgp: Cryptographic integrity compromise via key flag confusion     (CVE-2026-42784)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-38d57d2e7a advisory.

    Update sequoia-openpgp to version 2.3.0.

    This includes three security relevant fixes (assigned CVE-2026-42783, CVE-2026-42784, and CVE-not-     assigned-yet), see Notable fixes in the release notes: <https://gitlab.com/sequoia-     pgp/sequoia/-/raw/openpgp/v2.3.0/openpgp/NEWS>

    This update includes rebuilds of all affected applications to pick up the fixes for these issues.


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-8df732be8a advisory.

    Update sequoia-openpgp to version 2.3.0.

    This includes three security relevant fixes (assigned CVE-2026-42783, CVE-2026-42784, and CVE-not-     assigned-yet), see Notable fixes in the release notes: <https://gitlab.com/sequoia-     pgp/sequoia/-/raw/openpgp/v2.3.0/openpgp/NEWS>

    This update includes rebuilds of all affected applications to pick up the fixes for these issues.


    ----

    Update to version 1.10.2. Addresses [CVE-2026-2625](https://nvd.nist.gov/vuln/detail/CVE-2026-2625).

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in sequoia-openpgp. The library incorrectly infers key flags for older certificates when     a key flags subpacket is missing, leading to a discrepancy in how key capabilities are viewed. This key     flag confusion allows an attacker to bypass the back-signature check. Consequently, an attacker can     illegitimately bind an arbitrary subkey to their own certificate and forge signatures, completely     compromising cryptographic integrity. (CVE-2026-42784)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Fedora 44 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-5619c60e85 advisory.

    Update sequoia-openpgp to version 2.3.0.

    This includes three security relevant fixes (assigned CVE-2026-42783, CVE-2026-42784, and CVE-not-     assigned-yet), see Notable fixes in the release notes: <https://gitlab.com/sequoia-     pgp/sequoia/-/raw/openpgp/v2.3.0/openpgp/NEWS>

    This update includes rebuilds of all affected applications to pick up the fixes for these issues.


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the rust- rpm-sequoia-1.10.2.1-1.el9 build changelog.

  - Update sequoia-openpgp to version 2.3.0.  This includes three security relevant fixes (assigned     CVE-2026-42783, CVE-2026-42784, and CVE-not-assigned-yet), see Notable fixes in the release notes:
    <https://gitlab.com/sequoia-pgp/sequoia/-/raw/openpgp/v2.3.0/openpgp/NEWS>  This update includes rebuilds     of all affected applications to pick up the fixes for these issues.  (CVE-2026-42784)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 45 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-5272623baf advisory.

    Update sequoia-openpgp to version 2.3.0.

    This includes three security relevant fixes (assigned CVE-2026-42783, CVE-2026-42784, and CVE-not-     assigned-yet), see Notable fixes in the release notes: <https://gitlab.com/sequoia-     pgp/sequoia/-/raw/openpgp/v2.3.0/openpgp/NEWS>

    This update includes rebuilds of all affected applications to pick up the fixes for these issues.


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
363934	AlmaLinux 9 : rust-rpm-sequoia (ALSA-2026:76733)	Nessus	Alma Linux Local Security Checks	Local	high
363932	AlmaLinux 10 : rust-rpm-sequoia (ALSA-2026:76734)	Nessus	Alma Linux Local Security Checks	Local	high
363925	AlmaLinux 10 : rust-sequoia-sqv (ALSA-2026:76735)	Nessus	Alma Linux Local Security Checks	Local	high
363923	RockyLinux 10 : rust-sequoia-sq (RLSA-2026:76737)	Nessus	Rocky Linux Local Security Checks	Local	high
363920	RHEL 10 : rust-sequoia-sq (RHSA-2026:76737)	Nessus	Red Hat Local Security Checks	Local	high
363815	RockyLinux 10 : rust-rpm-sequoia (RLSA-2026:76734)	Nessus	Rocky Linux Local Security Checks	Local	high
363813	RockyLinux 10 : rust-sequoia-sqv (RLSA-2026:76735)	Nessus	Rocky Linux Local Security Checks	Local	high
363747	RockyLinux 9 : rust-rpm-sequoia (RLSA-2026:76733)	Nessus	Rocky Linux Local Security Checks	Local	high
363467	Oracle Linux 10 : rust-sequoia-sqv (ELSA-2026-76735)	Nessus	Oracle Linux Local Security Checks	Local	high
363464	Oracle Linux 10 : rust-rpm-sequoia (ELSA-2026-76734)	Nessus	Oracle Linux Local Security Checks	Local	high
363390	RHEL 10 : rust-sequoia-sqv (RHSA-2026:76735)	Nessus	Red Hat Local Security Checks	Local	high
363388	RHEL 10 : rust-rpm-sequoia (RHSA-2026:76734)	Nessus	Red Hat Local Security Checks	Local	high
363377	RHEL 9 : rust-rpm-sequoia (RHSA-2026:76733)	Nessus	Red Hat Local Security Checks	Local	high
317019	Fedora 43 : rust-rpm-sequoia / rust-sequoia-chameleon-gnupg / rust-sequoia-git / etc (2026-38d57d2e7a)	Nessus	Fedora Local Security Checks	Local	critical
317012	Fedora 42 : rust-rpm-sequoia / rust-sequoia-chameleon-gnupg / rust-sequoia-git / etc (2026-8df732be8a)	Nessus	Fedora Local Security Checks	Local	medium
316501	Linux Distros Unpatched Vulnerability : CVE-2026-42784	Nessus	Misc.	Local	high
315612	Fedora 44 : rust-podman-sequoia / rust-rpm-sequoia / etc (2026-5619c60e85)	Nessus	Fedora Local Security Checks	Local	critical
315235	CentOS 9 : rust-rpm-sequoia-1.10.2.1-1.el9	Nessus	CentOS Local Security Checks	Local	critical
314202	Fedora 45 : rust-podman-sequoia / rust-rpm-sequoia / etc (2026-5272623baf)	Nessus	Fedora Local Security Checks	Local	critical

Detections

Analytics

CVE-2026-42784

high

Tenable Plugins

Coming Soon

high

high

high

high

high

high

high

high

high

high

high

high

high

critical

medium

high

critical

critical

critical