CVE-2026-34181: PKCS#12 Files with PBMAC1 Are Accepted with Short HMAC Keys

Synopsis

This is an input-validation vulnerability in OpenSSL's PKCS#12 file processing. The flaw is reachable over the network without authentication, but exploitation requires the attacker to win a 1-in-256 probability check per attempt, placing it in the high-complexity category. A successful attacker can cause a service to accept a forged certificate and private key, enabling identity impersonation and data tampering. Patched-image rebuilds at OpenSSL versions 3.4.6, 3.5.7, 3.6.3, and 4.0.1 are available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable PKCS#12 parsing endpoint must be reachable over the network, so the attacker submits a crafted file to a remotely exposed service.

• AuthenticationNot required

  No account or credential is needed before submitting the malicious PKCS#12 file; the attacker interacts with the service as an unauthenticated party.

• Victim interactionNot required

  No user action is required; the vulnerability triggers when the service itself processes the attacker-supplied file.

• Attack complexityDetail

  Exploitation is probabilistic rather than reliable: the attacker must win a 1-in-256 chance per attempt, which typically means repeated submissions until a crafted file is accepted, introducing a measurable environmental hurdle.

Blast Radius

• The attacker injects a certificate and private key of their choosing, causing the target service to treat those credentials as legitimate.
• Any identity or trust decision the service makes based on the accepted certificate is undermined, enabling impersonation of the certificate's stated subject.
• Private key material supplied by the attacker can be used for subsequent decryption or signing operations performed by the service, extending the attacker's reach beyond the initial forgery.