1.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-27448

CVE-2026-27448: pyOpenSSL allows TLS connection bypass via unhandled callback exception in set_tlsext_servername_callback

pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 0.14.0 and prior to version 26.0.0, if a user provided callback to set_tlsext_servername_callback raised an unhandled exception, this would result in a connection being accepted. If a user was relying on this callback for any security-sensitive behavior, this could allow bypassing it. Starting in version 26.0.0, unhandled exceptions now result in rejecting the connection.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-27448

CVE-2026-27448:

1.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
pyopenssl	pip	>= 0.14.0, < 26.0.0	26.0.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of the security vulnerability was based on the provided commit d41a814759a9fb49584ca8ab3f7295de49a85aa0. The patch clearly shows modifications to the set_tlsext_servername_callback method in the src/OpenSSL/SSL.py file. The core of the vulnerability was a lack of exception handling for a user-provided callback function. When this callback failed, the system would 'fail open', meaning it would proceed with the connection as if everything was successful, thereby bypassing any security validation intended by the developer in the callback. The fix involves adding a try...except block to catch any exceptions from the callback, log the error, and then explicitly terminate the TLS handshake by returning _lib.SSL_TLSEXT_ERR_ALERT_FATAL. This ensures the system 'fails closed' and prevents the connection bypass. The vulnerable function is therefore Context.set_tlsext_servername_callback as it is responsible for setting up this insecure callback mechanism.

Vulnerable functions

Context.set_tlsext_servername_callback

src/OpenSSL/SSL.py

The vulnerability lies within the `set_tlsext_servername_callback` method, which is responsible for setting a callback function to handle Server Name Indication (SNI) during a TLS handshake. Prior to the patch, the internal `wrapper` function that executes the user-provided callback did not handle exceptions. If the user's callback code raised an exception, it would propagate uncaught, causing the library to implicitly treat the operation as successful and allow the TLS connection to proceed. This 'fail-open' behavior could lead to security checks within the callback being bypassed. The patch corrects this by wrapping the callback execution in a `try...except` block. If an exception occurs, it is now caught, logged, and a fatal TLS alert is returned, securely terminating the connection.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.