CVE-2026-89422Patch

LOWCVSS 9.3 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Key Exchange without Entity Authentication vulnerability in Erlang/OTP ssl allows a peer that answers a TLS 1.3 client connection to impersonate the intended server. A pre_shared_key extension in the ServerHello that the client never offered causes the client to complete the handshake without validating the server's certificate, so ssl:connect returns {ok, Socket} against a peer holding no certificate, no private key and no prior session. tls_client_connection_1_3:handle_server_hello/2 passes the received extension to tls_gen_connection_1_3:handle_resumption/2, which sets resumption = true on its mere presence without checking that the client offered a PSK. tls_handshake_1_3:get_pre_shared_key/4 meanwhile falls back to the all-zero "no PSK" value and keys the handshake with the ordinary non-PSK schedule, so the attacker's own ephemeral key suffices. The resumption flag then routes maybe_resumption/1 straight to wait_finished, skipping the certificate-handling states, so certificate path validation, verify_fun, hostname verification, partial_chain, CRL checking and OCSP stapling are all bypassed. The default client configuration is affected; clients restricted to TLS 1.2 are not. This issue affects OTP from OTP 22.2 before OTP 27.3.4.18, OTP 28.5.0.7, and OTP 29.1.1, corresponding to ssl from 9.5 before 11.2.12.13, 11.6.0.6, and 11.7.7.

Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-322

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

DECLINING

Threat summary

Patch or workaround signal is available
9 mentions across 4 observed days
Momentum state: declining

What's happening

Patch or workaround mentioned in 5 signals
Technical details provided in 8 signals
Disclosure: 4 classified signals
Peaked 3d ago at 6 mentions (2026-09-22); latest day: 1
9 total mentions across 4 days

Deep dive

Activity timeline9 mentions / 4d

Signal classification2 categories

Patch

555.6%

Disclosure

444.4%

Referenced assets7 URLs

By indicator

Classification over time

Date	Total	Labels

2026-09-22	6	Disclosure2Patch4
2026-09-23	1	Patch1
2026-09-25	1	Disclosure1
2026-10-23	1	Disclosure1

Full discourse9 posts

HOL@HashgraphOnline46d
Disclosure
Anyone who answers your Erlang TLS 1.3 connect can finish the handshake without a certificate. Default ssl:connect trusts them. They get your tokens and forge responses. https://hol.org/blog/cve-2026-89422-erlang-otp-tls13-unsolicited-psk-auth-bypass https://t.co/ilhswaweN1
Post summary
The post discloses a CVE affecting Erlang OTP TLS 1.3 where a peer can complete ssl:connect without a certificate and steal tokens or forge responses. It lacks explicit PoC, exploit tooling, active exploitation, patch, or false-positive claims.
1101601.1K
19.2K followersView on X
Dark Web Intelligence@DailyDarkWeb46d
Patch
🚨 ERLANG/OTP CRITICAL — TLS 1.3 CLIENT SKIPS SERVER AUTHENTICATION ON UNSOLICITED PSK Erlang/OTP has published a critical security advisory for CVE-2026-89422: a TLS 1.3 client flaw where an unsolicited ServerHello pre_shared_key extension can make ssl:connect succeed without Certificate / CertificateVerify checks. • Severity: Critical — CVSS 9.3 (CVSS:4.0) • GHSA: GHSA-rgxr-4g4w-j875 • Affected: OTP >= 22.2 until patched (default TLS 1.3 clients with verify_peer) • Impact: full server impersonation / MITM — attacker can hold traffic keys • Patched: OTP 29.1.1, 28.5.0.7, 27.3.4.18 (ssl 11.7.7 / 11.6.0.6 / 11.2.12.13) • Workaround until patched: restrict clients to TLS 1.2 (no TLS 1.3-safe configuration) • Credits: Milad Nasr and Luna Tong (Anthropic) ⚠️ Analyst Note: This is an official Erlang/OTP GitHub Security Advisory published September 22, 2026. Any application or platform using Erlang/OTP’s ssl client for TLS 1.3 with default verify_peer behavior should treat patching as urgent. A same-day High companion advisory (GHSA-qhcm-px9c-rvfh) covers SSH session channel exhaustion DoS after authentication and ships on the same patch trains — footnote only; the lead is the TLS 1.3 client auth skip. Official advisory: https://github.com/erlang/otp/security/advisories/GHSA-rgxr-4g4w-j875 #DDW #DarkWeb #CyberSecurity #ThreatIntelligence #Erlang #OTP #TLS
Post summary
The advisory discloses a critical TLS 1.3 client authentication bypass in Erlang/OTP (CVE‑2026‑89422, CVSS 9.3) and provides patched releases plus a TLS 1.2 workaround, with a link to the official GitHub advisory.
000536.8K
209.0K followersView on X
Ryx@PadhiyarRushi45d
Patch
Erlang/OTP TLS 1.3 client will skip server cert checks if the ServerHello offers a PSK you never asked for CVE-2026-89422 / GHSA-rgxr-4g4w-j875, published Sept 22. A pre_shared_key extension the client did not offer completes the handshake with no certificate validation. Any ssl:connect path that negotiates TLS 1.3 (default), including httpc over HTTPS, is in scope. On-path or malicious server = full impersonation. Fixed in OTP 29.1.1 / 28.5.0.7 / 27.3.4.18. https://github.com/erlang/otp/security/advisories/GHSA-rgxr-4g4w-j875 #Cybersecurity #AI #AISecurity #MCP #Claude #GPT #Infosec #Trending #TLS #SupplyChain #AppSec
Post summary
The post discloses a critical TLS 1.3 certificate validation bypass in Erlang/OTP (CVE-2026-89422) and provides specific fixed versions for remediation.
01021354
954 followersView on X
Anthony Bahn@HoustonIntrove146d
Patch
If I ran RabbitMQ this morning I'd check OTP first. CVE-2026-89422: TLS 1.3 peers can send an unsolicited PSK and your client skips every cert check (CVSS 9.3). Patch 27.3.4.18 / 28.5.0.7 / 29.1.1. No TLS 1.3-preserving workaround. https://app.opencve.io/cve/CVE-2026-89422
Post summary
The tweet discloses CVE-2026-89422 involving a RabbitMQ TLS 1.3 certificate check bypass (CVSS 9.3) and explicitly names fixed versions for patching, without reporting active exploitation or providing PoC code.
1001039
38 followersView on X
VulniPulse@vulnipulse15d
Disclosure
CVE advisory: CVE-2026-89422 - netapp: CVE-2026-89422 Erlang/OTP Vulnerability in NetApp Products. https://vulnipulse.com/advisories/netapp-ntap-20261023-0012 #CVE #CyberSecurity #NetApp #ONTAP
Post summary
The text announces CVE-2026-89422, an Erlang/OTP vulnerability affecting NetApp ONTAP products, and links to a vulnerability advisory page. No PoC, exploit, patch, or active exploitation details are provided in the text itself.
1000024
34 followersView on X
Cybersecurity News DE@cybsecuritynews43d
Disclosure
#schwachstellen Erlang/OTP: Kritische TLS-1.3-Schwachstelle erlaubt Server-Imitation ohne Zertifikat #cve202689422 #erlangotp #ssl #tls13 https://cybersecurity-news.de/erlang-otp-cve-2026-89422-tls-1-3-server-imitation
Post summary
The tweet discloses a critical TLS 1.3 server-impersonation vulnerability in Erlang/OTP (CVE-2026-89422) but includes no exploit code, PoC, patch, or active-exploitation evidence.
0000036
15 followersView on X
Anthony Bahn@HoustonIntrove146d
Patch
ssl:connect said ok. The peer had no cert and no key. CVE-2026-89422 in Erlang/OTP TLS 1.3: an unsolicited pre_shared_key skips every certificate check. Patch to 27.3.4.18, 28.5.0.7, or 29.1.1. Or pin TLS 1.2 until then. https://cna.erlef.org/cves/CVE-2026-89422.html
Post summary
The tweet confirms CVE-2026-89422 in Erlang/OTP TLS 1.3, detailing how an unsolicited pre_shared_key bypasses certificate checks, and explicitly lists fixed versions (27.3.4.18, 28.5.0.7, 29.1.1) along with a TLS 1.2 workaround.
0000037
38 followersView on X
HOL@HashgraphOnline46d
Patch
Patched in OTP 29.1.1 / 28.5.0.7 / 27.3.4.18 (CVE-2026-89422). Same bump clears SSH + ASN.1 DoS siblings. No TLS 1.3-preserving workaround. Upgrade, or force TLS 1.2 until you can.
Post summary
The post announces specific patched versions for CVE-2026-89422 and related SSH/ASN.1 DoS vulnerabilities, advising users to upgrade or force TLS 1.2 as a temporary workaround.
00000145
19.3K followersView on X
CVE@CVEnew46d
Disclosure
CVE-2026-89422 Key Exchange without Entity Authentication vulnerability in Erlang/OTP ssl allows a peer that answers a TLS 1.3 client connection to impersonate the intended server. … https://www.cve.org/CVERecord?id=CVE-2026-89422
Post summary
The text announces CVE-2026-89422, describing a key exchange without entity authentication flaw in Erlang/OTP SSL that allows server impersonation during TLS 1.3 client connections, but provides no evidence of active exploitation, PoC code, named exploits, or available patches/workarounds.
00000956
58.1K followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2026-89422

Dark Web Intelligence[verified]@DailyDarkWebPatch

The advisory discloses a critical TLS 1.3 client authentication bypass in Erlang/OTP (CVE‑2026‑89422, CVSS 9.3) and provides patched releases plus a TLS 1.2 workaround, with a link to the official GitHub advisory.

Ryx[verified]@PadhiyarRushiPatch

The post discloses a critical TLS 1.3 certificate validation bypass in Erlang/OTP (CVE-2026-89422) and provides specific fixed versions for remediation.

Anthony Bahn[verified]@HoustonIntrove1Patch

The tweet discloses CVE-2026-89422 involving a RabbitMQ TLS 1.3 certificate check bypass (CVSS 9.3) and explicitly names fixed versions for patching, without reporting active exploitation or providing PoC code.

VulniPulse[verified]@vulnipulseDisclosure

The text announces CVE-2026-89422, an Erlang/OTP vulnerability affecting NetApp ONTAP products, and links to a vulnerability advisory page. No PoC, exploit, patch, or active exploitation details are provided in the text itself.

Anthony Bahn[verified]@HoustonIntrove1Patch

The tweet confirms CVE-2026-89422 in Erlang/OTP TLS 1.3, detailing how an unsolicited pre_shared_key bypasses certificate checks, and explicitly lists fixed versions (27.3.4.18, 28.5.0.7, 29.1.1) along with a TLS 1.2 workaround.

HOL@HashgraphOnlineDisclosure

The post discloses a CVE affecting Erlang OTP TLS 1.3 where a peer can complete ssl:connect without a certificate and steal tokens or forge responses. It lacks explicit PoC, exploit tooling, active exploitation, patch, or false-positive claims.

Cybersecurity News DE@cybsecuritynewsDisclosure

The tweet discloses a critical TLS 1.3 server-impersonation vulnerability in Erlang/OTP (CVE-2026-89422) but includes no exploit code, PoC, patch, or active-exploitation evidence.

HOL@HashgraphOnlinePatch

The post announces specific patched versions for CVE-2026-89422 and related SSH/ASN.1 DoS vulnerabilities, advising users to upgrade or force TLS 1.2 as a temporary workaround.