CVE-2026-45389: In OCaml-TLS before 2

Synopsis

An authentication bypass vulnerability exists in the OCaml-TLS server implementation before version 2.1.0. The server fails to properly validate whether a client-provided certificate is actually permitted for client authentication, specifically by skipping checks on KeyUsage and ExtendedKeyUsage certificate extensions. This allows a remote, unauthenticated attacker to impersonate a legitimate client using any certificate not intended for client authentication, gaining unauthorized access to data and the ability to tamper with protected resources. HarborGuard tracks this advisory and will make a patched-image rebuild available as soon as an upstream fix version is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable TLS server must be reachable over the network; an attacker sends a crafted client certificate during a TLS handshake from a remote connection.

• AuthenticationNot required

  No prior credentials are needed; the flaw exists precisely in the authentication step, so an attacker with no account can exploit it by presenting an unintended certificate.

• Victim interactionNot required

  The attack is fully server-side and requires no action from any user or administrator on the target system.

• Attack complexityDetail

  Exploit conditions are reliable and free of race conditions or environmental dependencies; a suitable non-client-auth certificate is the only prerequisite.

Blast Radius

• An attacker reads data the server exposes to authenticated clients, including session tokens, application records, or other protected resources.
• An attacker modifies or submits data as an impersonated client identity, potentially altering persisted records or triggering privileged application actions.
• Availability is not directly impacted according to the CVSS scoring (A:N), so service disruption is not a direct outcome of this exploit path.
• Any system relying on mutual TLS for access control is fully bypassed, meaning downstream services that trust the impersonated client identity are also exposed.