hackney: Improper certificate validation with custom trust store
Summary
The Erlang HTTP client library hackney keeps a certifi-based partial_chain callback when an application pins a private CA via cacerts or cacertfile. OTP then accepts any peer chain that contains a publicly trusted root, so the pinned CA is bypassed. An on-path attacker who holds a publicly trusted certificate for the pinned hostname can impersonate the server and read or modify traffic. Default certifi trust is not affected.
Affected
- hackney 1.24.0 to before 4.9.0
- Commit range d8a9afc to 915eb57 (per CNA record)
- Only connections that pass cacerts or cacertfile in ssl_options without their own partial_chain
Fixed in
- hackney 4.9.0 (fix in PR #978, commit 915eb57)
- Note: some downstream projects use 4.9.1; verify the Hex package version before pinning
Workaround
- Pass your own {partial_chain, Fun} in ssl_options alongside cacerts or cacertfile (a callback returning unknown_ca validates against the configured CAs only)
- Otherwise no vendor workaround is documented; upgrading is the fix
Exploitation
- No evidence of exploitation in the wild found
- No public proof of concept found
- CISA KEV: not checked
Our recommendation
- Find Elixir/Erlang projects depending on hackney (directly or via HTTPoison, ex_aws) and check lock files for versions 1.24.0 to 4.8.x
- Upgrade to hackney 4.9.0 or later after confirming the Hex package version
- Check whether any connection passes cacerts or cacertfile in ssl_options; these are the affected cases
- Run mix hex.audit on Elixir projects
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE record CVE-2026-115693 (EEF CNA) cna.erlef.org
- OSV record EEF-CVE-2026-115693 osv.dev
- Fix commit 915eb57 github.com
- Introducing commit d8a9afc github.com
- Fix pull request #978 github.com
- hackney 4.9.0 release github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 05:24.
Original description (NVD)
Improper Certificate Validation vulnerability in hackney_ssl in benoitc hackney allows an on-path attacker to impersonate a server pinned to a private certificate authority via a certificate chain that ends in a publicly trusted root. hackney adds {partial_chain, fun hackney_ssl:partial_chain/1} to every verify_peer configuration. The callback returns any certificate in the peer chain whose public key matches a root in the bundled certifi store as the trust anchor, and OTP honours that callback over the configured cacerts. hackney_ssl:merge_ssl_opts/3 kept the callback when the caller replaced the trust store with cacerts or cacertfile in ssl_options, so a connection pinned to a private CA still accepted any chain that carried a publicly trusted root. The hostname check still applies, so the attacker needs a publicly trusted certificate for the pinned hostname. This issue affects hackney: from 1.24.0 before 4.9.0.
NVD references (6)
- https://cna.erlef.org/cves/CVE-2026-115693.html
- https://github.com/benoitc/hackney/commit/915eb5737e9c489d8fc22eec8cdae30e9b027be4
- https://github.com/benoitc/hackney/commit/d8a9afcf5c3849904274e2eba1df56c63d1a1a0c
- https://github.com/benoitc/hackney/pull/978
- https://github.com/benoitc/hackney/releases/tag/4.9.0
- https://osv.dev/vulnerability/EEF-CVE-2026-115693
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.