Abstract

This article analyzes NotCVE-2026-0001, a critical security vulnerability in Cloudflare's Universal SSL, where the automatic injection of permissive CAA records actively nullifies the IETF standard RFC 8657. By overriding user-defined account binding parameters, this configuration re-opens the exact security gap exploited in the 2023 jabber.ru MitM attack, leaving millions of domains vulnerable to BGP hijacking and unauthorized TLS certificate issuance. The analysis demonstrates that this is not a technical oversight but a design choice that neutralizes the `accounturi` and `validationmethods` security controls, and argues that Cloudflare must implement strict ACME account binding to mitigate this risk.

Vulnerability Status: Formally Tracked

As of January 21, 2026, this vulnerability is being formally tracked by multiple security coordination bodies:

• CERT/CC (VINCE): Report VU#840183 (Status: Open)
• NotCVE ID: NotCVE-2026-0001^[1]
  • Severity: CVSS 8.7 (High)
    • Attack Vector: Network-based (BGP hijacking, network interception)
    • Impact: Critical (Domain Integrity, TLS MITM capability)

Technical Classification

The vulnerability has been formally classified under the following enumeration standards:

• CWE-1188 : Insecure Default Initialization of Resource (Core issue: Cloudflare defaults to insecure CAA injection).
• CWE-693 : Protection Mechanism Failure (Failure of the accounturi restriction).
• CAPEC-94 : Adversary in the Middle (AiTM) (The resulting attack vector).
• CAPEC-584 : BGP Route Disabling / Manipulation (Prerequisite for the attack).
• CAPEC-598 : DNS Spoofing (Alternative network manipulation vector).

TL;DR

The Mechanism

Cloudflare’s Universal SSL injects permissive CAA records that override user DNS constraints, causing certificate authorities to ignore strict account-binding checks.

The Risk

This enables BGP hijacking and network interception to obtain unauthorized TLS certificates by bypassing accounturi and validationmethods.

The Precedent

The configuration replicates the gap exploited in the 2023 jabber.ru MitM, where intercepted traffic satisfied http-01 validation challenges.

The Mitigation

Cloudflare must stop overriding user DNS records or fully implement RFC 8657 to restrict certificate issuance to the domain owner’s authorized ACME account.

UPDATE (January 2026): The Venezuela Confirmation

In January 2026, a massive BGP leak involving Venezuela’s state-owned ISP (CANTV, AS8048) made global headlines. In their analysis of the incident, Cloudflare explicitly stated that “BGP route leaks happen all of the time, and they have always been part of the Internet.” ^[1a]

This admission highlights exactly why the security gap described in this article is so critical. If BGP leaks are “common” (whether accidental or malicious), then the network layer cannot be trusted for domain validation.

Yet, as detailed below, Cloudflare’s Universal SSL default configuration actively disables the specific IETF standard (RFC 8657) designed to prevent these common BGP leaks from being weaponized to issue fraudulent certificates.

I have opened a new discussion on this specific contradiction with the Cloudflare team.

By David Osipov

• ISNI: 0000 0005 1802 960X
• ORCID: 0009-0005-2713-9242
• VIAF: 139173726847611590332
• Wikidata: Q130604188