Cloudflare Universal SSL Automatic CAA RRset Management protection mechanism

Summaryinfo

A vulnerability identified as problematic has been detected in Cloudflare Universal SSL. Affected by this issue is some unknown functionality of the component Automatic CAA RRset Management. Performing a manipulation results in protection mechanism. This vulnerability was named CVE-2026-14440. The attack may be initiated remotely. In addition, an exploit is available. This product operates as a managed service, which prevents users from maintaining vulnerability countermeasures themselves. It is recommended to apply the suggested workaround.

Detailsinfo

A vulnerability was found in Cloudflare Universal SSL (affected version not known). It has been classified as problematic. This affects some unknown functionality of the component Automatic CAA RRset Management. The manipulation with an unknown input leads to a protection mechanism vulnerability. CWE is classifying the issue as CWE-693. The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product. This is going to have an impact on integrity. The summary by CVE is:

Description: To issue and renew TLS certificates on behalf of customers, Cloudflare's Universal SSL feature automatically manages the CAA RRset for the customer's zone. This auto-managed RRset is permissive by design (e.g. 'issue "letsencrypt.org"' without parameters). On Universal SSL zones, Cloudflare's authoritative DNS serves this auto-managed RRset at query time, superseding any customer-configured CAA records on the zone. When a customer publishes a stricter CAA record using the RFC 8657 accounturi or validationmethods parameters, the Certificate Authority does not observe those parameters when evaluating the served RRset under RFC 8659. As a result, the RFC 8657 account-binding and validation-method-binding protections are not enforced end-to-end on Universal SSL zones. Successful exploitation could result in issuance of a browser-trusted TLS certificate to an attacker, enabling MITM against the affected domain. Exploitation is non-trivial in practice: an attacker would need to hold an ACME account at one of the Certificate Authorities in the served CAA RRset and to simultaneously satisfy domain control validation across the multiple geographically distinct Network Perspectives the CA relies on for Multi-Perspective Issuance Corroboration. Cloudflare prefixes are anycast-announced from hundreds of locations globally, raising the bar against single-vantage-point BGP hijacks. Any resulting misissuance of a browser-trusted certificate is subject to Certificate Transparency logging required by major browsers, and would be visible to CT monitoring. Mitigation:  Customers requiring strict RFC 8657 enforcement need to disable Universal SSL on the affected zone. Universal SSL's automatic CAA management and customer-set RFC 8657 accounturi and validationmethods enforcement are mutually exclusive by the nature of the issue, so there is no in-product workaround that preserves both.  Certificate Transparency monitoring is recommended for all customers as a general detection control. Credits: David Osipov (ORCID: https://orcid.org/0009-0005-2713-9242), independent researcher

The weakness was presented by David Osipov as VA-26-183-01 as confirmed security advisory (GitHub) via CCCERT. It is possible to read the advisory at raw.githubusercontent.com. The public release was coordinated in cooperation with Cloudflare. This vulnerability is uniquely identified as CVE-2026-14440 since 07/02/2026. The exploitability is told to be difficult. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details are unknown but a private exploit is available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 07/21/2026). Cloudflare Universal SSL can serve an automatically managed CAA RRset at query time that supersedes customer-configured CAA records. As a result, RFC 8657 accounturi and validationmethods restrictions may not be observed by the Certificate Authority and are not enforced end-to-end. Successful exploitation is non-trivial, but certificate misissuance could result in a browser-trusted TLS certificate and enable a man-in-the-middle attack against the affected domain.

The best possible mitigation is suggested to be Workaround. Customers can verify the effective CAA RRset observed by Certificate Authorities with dig CAA . This is a verification and detection step, not a preventive mitigation.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Cloud Software

Vendor

• Cloudflare

Name

• Universal SSL

Managed Service

• yes

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion