CVE-2026-69248: python-cryptography Wildcard DNS Name Vulnerability Allows Escape from Permitted Subtrees
Summary
CVE-2026-69248: python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees. Affects cryptography versions < 49.0.0. Fixed in 49.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The python-cryptography package is a widely used library in Python for cryptographic operations, including the creation and verification of certificates. It provides developers with tools to handle various cryptographic tasks securely. However, a vulnerability has been identified that allows for improper validation of DNS names in certificates, which can lead to security breaches.
Vulnerability Detail
The vulnerability arises when an intermediate constrained Certificate Authority (CA) permits a specific DNS name, such as 'foo.example.com', while the leaf certificate contains a wildcard DNS Subject Alternative Name (SAN) like '*.example.com'. The python-cryptography verifier incorrectly accepts this wildcard, allowing it to escape the constraints set by the CA. This can lead to the acceptance of invalid certificate chains, posing a significant security risk as it undermines the intended restrictions of the CA.
How To Fix
Latest published version: 50.0.2 as of 22 Oct 2026
pip install --upgrade "cryptography==50.0.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
49.0.0
This is the first release that contains the fix.
pip install --upgrade "cryptography==49.0.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using wildcard DNS names in certificates that are issued by constrained CAs. Instead, explicitly specify the allowed DNS names to ensure compliance with the CA's constraints.
Conclusion
The python-cryptography vulnerability CVE-2026-69248 poses a significant risk by allowing wildcard DNS names to bypass CA constraints. It is crucial to update to the patched version 49.0.0 or later to mitigate this risk. Additionally, using Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for cryptography →
FAQ
CVE-2026-69248 is a vulnerability in the python-cryptography package that allows wildcard DNS names to escape from permitted subtrees, leading to potential security risks.
If your application uses the affected version of python-cryptography and relies on certificate validation, it may accept invalid certificates, compromising security.
As a temporary measure, avoid using wildcard DNS names in your certificates and ensure that only explicitly permitted DNS names are used.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 6.9, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for cryptography.
