CVE-2026-71886

{
  "etk_id": "ETK-2026-462",
  "cve_id": "CVE-2026-71886",
  "display_id": "CVE-2026-71886",
  "ghsa_id": "GHSA-7hrr-mw36-px4x",
  "euvd_id": "EUVD-2026-92002",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Missing certification-key authorization in bcpg OpenPGP API",
  "summary": "bcpg versions before 1.86 can treat third-party OpenPGP certifications or trust delegations from an unauthorized subkey as attributable to the issuing certificate. An attacker must control a signing-capable component key that lacks certification authority, and the affected application must use the high-level API result to make identity or introducer-trust decisions.",
  "mitigation": "Upgrade bcpg to version 1.86 or later. Until upgrading, reject certification and delegation assertions unless the signing key is the primary key or was authorized for certification when the assertion was made.",
  "vendor": "Legion of the Bouncy Castle Inc.",
  "product": "BC-JAVA",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 1.81, < 1.86"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "1.86"
      ],
      "package_name": "bcpg",
      "purl": null
    }
  ],
  "cwes": [
    863
  ],
  "cvss_score": 8.2,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/U:Amber",
  "epss_score": 0.0017,
  "epss_percentile": 0.0562,
  "epss_asof": "2026-10-21",
  "automation": "contextual",
  "check": true,
  "check_confidence_basis": "mechanism_verified",
  "exploit": false,
  "pipeline_minutes": 13.431701833333333,
  "t0_at": "2026-10-03T08:46:33.868000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-03T14:42:56.148036+00:00",
      "days": 0.24748009300925927,
      "is_lower_bound": false,
      "measured_at": "2026-10-03T08:46:33.868000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-03T08:46:33.868000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-03T08:46:33.868000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-71886"
    }
  }
}