CVE-2026-103503
Hex trusts its bundled CA certificates when cacerts_path is set
Improper Certificate Validation vulnerability in hexpm hex allows an attacker who can intercept HTTPS connections, and holds a certificate for a Hex host issued by a CA in Hex's bundled CA store, to impersonate that host to users who set cacerts_path to a CA store that leaves that CA out. cacerts_path (HEX_CACERTS_PATH) is documented as the path to the CA certificate store, used instead of the CA bundle that ships with Hex. Hex.HTTP.SSL.ssl_opts/1 passes the configured store as the cacerts option, but builds the partial_chain callback from the bundled store whether cacerts_path is set or not. Hex.HTTP.SSL.partial_chain/2 accepts a server chain when any certificate in it has the same public key as a bundled CA certificate, so a chain that leads to a bundled CA passes verification although the configured store doesn't contain that CA. Hostname verification still applies. This issue affects hex: from 0.20.2 before 2.5.2.
Fixes and workarounds
Fix
Upgrade Hex to 2.5.2 or later, for example with mix local.hex. With cacerts_path (HEX_CACERTS_PATH) set, Hex then only accepts server certificates that chain to a CA in that file, and it doesn't trust copies of CA certificates sent by the server.
Source: CNA: EEFWorkaround
There's no Hex configuration that stops the bundled CAs from being trusted.
Source: CNA: EEFFix
The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.
Source: CNA: EEFFix
The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.
Source: CNA: EEFAffected products and versions
| Product | Versions | Authority |
|---|---|---|
| hex hexpm hex
otp |
≥ 0.20.2; < 2.5.2 (affected, semver)
Other versions: unaffected |
CNA: EEF |
| hex hexpm hexpm/hex
github |
≥ c9b26a46928bfcd546773571e09c1d05f4cd9fb7; < * (affected, git); unaffected at 5f5a2136c7cf5991b6e8a30d645ca9f8e74b0785; unaffected at 6232a6498015e559743bec4f4fbec9138837cec8
Other versions: unaffected |
CNA: EEF |
Version ranges are source assertions. Check the vendor advisory and your installed configuration before determining exposure.
CVSS assessments
| Version / score | Vector | Authority |
|---|---|---|
| 4.0 / 5.9 medium |
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N | CNA: EEF |
Exploit evidence
No exploit evidence in collected sources. This is not proof of no exploitation.
References
- https://github.com/hexpm/hex/security/advisories/GHSA-rw8q-hg7m-cxgrCNA: EEF · related, vendor-advisory
- https://cna.erlef.org/cves/CVE-2026-103503.htmlCNA: EEF · related
- https://osv.dev/vulnerability/EEF-CVE-2026-103503CNA: EEF · related
- https://github.com/hexpm/hex/commit/c9b26a46928bfcd546773571e09c1d05f4cd9fb7CNA: EEF · related
- https://github.com/hexpm/hex/commit/5f5a2136c7cf5991b6e8a30d645ca9f8e74b0785CNA: EEF · patch
- https://github.com/hexpm/hex/commit/6232a6498015e559743bec4f4fbec9138837cec8CNA: EEF · patch
For agents and automation
Read public disclosures for free as Markdown or JSON. Compatible browsers also expose native WebMCP tools to search disclosures, read this page, and discover API access.
Use the ontology-linked Cyber API with x402 pay per request, or a Y2 Pro or Elite API key with the intel:cyber scope.
Endpoints and access details
https://api.y2.dev/api/v2/cyber/cveshttps://api.y2.dev/api/v2/cyber/cves/{cveId}
A workspace owner or admin can create a Pro or Elite API key. Send Authorization: Bearer <Y2_API_KEY> from your trusted agent runtime.
For x402, omit Authorization and read the HTTP 402 payment challenge before signing a retry. Public browser tools do not make payments.