Skip to content
OpenAdvisories

Weakness (CWE)

CWE-296: Improper Following of a Certificate's Chain of Trust

Base Draft

The product does not follow, or incorrectly follows, the chain of trust for a certificate back to a trusted root certificate.

More detail

There are several ways in which the chain of trust might be broken, including but not limited to:

- Any certificate in the chain is self-signed, unless it is the root.

- Not every intermediate certificate is checked, starting from the original certificate all the way up to the root certificate.

- An intermediate, CA-signed certificate does not have the expected Basic Constraints or other important extensions.

- The root certificate has been compromised or authorized to the wrong party.

How to prevent it (3 mitigations)

  1. Architecture and Design

    Ensure that proper certificate checking is included in the system design.

  2. Implementation

    Understand, and properly implement all checks necessary to ensure the integrity of certificate trust integrity.

  3. Implementation

    If certificate pinning is being used, ensure that all relevant properties of the certificate are fully validated before the certificate is pinned, including the full chain of trust.

Source: MITRE CWE-296

All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Medium 4.8
    CVE-2025-10539

    Improper TLS Certificate Validation RCE via Malicious Update in DeskTime Time Tracking App

    Due to improper TLS certificate validation in the DeskTime Time Tracking App before version 1.3.674, attackers who can position themselves in the network path between the client and the DeskTime update servers can return a malicious executable in response to …

    DeskTime DeskTime Time Tracking App
  • Medium 6.5
    CVE-2026-33779

    Junos OS: SRX Series: Insufficient certificate verification for device to SD cloud communication

    An Improper Following of a Certificate's Chain of Trust vulnerability in J-Web of Juniper Networks Junos OS on SRX Series allows a PITM to intercept the communication of the device and get access to confidential information and potentially modify it. When an …

    Juniper Networks Junos OS Network devices
  • Medium 5.9
    CVE-2026-27133

    Strimzi All CAs from CA chain will be trusted in Kafka Connect and Kafka MirrorMaker 2 target clusters

    Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations. From 0.47.0 to before 0.50.1, when a chain consisting of multiple CA (Certificate Authority) certificates is used in the trusted certificate…

    strimzi strimzi-kafka-operator
  • Medium 5.9
    GHSA-mjcp-gpgx-ggcg

    OpenTofu incorrectly validates excluded subdomain constraint in conjunction with TLS certificates containing wildcard SANs

    When OpenTofu is acting as a TLS client authenticating a certificate chain provided by a TLS server, an excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard [SANs](https://en.wikipedia.org/wiki/Public_key_certificate#Su…

    github.com/opentofu/opentofu Go
  • Medium 4.8
    CVE-2025-22459

    Improper certificate validation in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a …

    ivanti Endpoint Manager Network devices
  • Medium 4.3
    CVE-2024-43196

    IBM OpenPages data manipulation

    IBM OpenPages with Watson 8.3 and 9.0  application could allow an authenticated user to manipulate data in the Questionnaires application allowing the user to spoof other users' responses.

    IBM OpenPages with Watson