onyx --cves cve-2026-14440
CVE-2026-14440
- score
- 0.1
- cvss
- 6.8
- epss
- 0.2%
- published
- 2026-07-01
- kev added
- —
- first seen
Cloudflare Universal SSL automatically manages permissive CAA RRsets, superseding customer-configured stricter CAA records with RFC 8657 parameters, letting attackers potentially obtain browser-trusted TLS certificates, exploit requires attacker to hold ACME account and pass multi-perspective domain validation.
Timeline
How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.
- Published
- Tracked by Onyx
Weaknesses
References 8
- https://community.cloudflare.com/t/critical-security-gap-cloudflare-must-fully-support-rfc-8657-caa/799999/10
- https://community.cloudflare.com/t/universal-ssl-exposes-domains-to-bgp-leaks-re-venezuela-analysis/879930
- https://david-osipov.vision/en/blog/cybersecurity/cloudflare-ssl-mitm-flaw-2026/
- https://zenodo.org/records/18330221
- https://developers.cloudflare.com/ssl/edge-certificates/caa-records/
- https://developers.cloudflare.com/ssl/edge-certificates/universal-ssl/limitations/
- https://www.rfc-editor.org/rfc/rfc8657
- https://www.rfc-editor.org/rfc/rfc8659