AI Summary
A newly disclosed vulnerability in Cloudflare's Universal SSL, CVE-2026-14440, reveals that platform CAA records can override user settings, creating potential risks for domain certificate control.
- •CVE-2026-14440 identified where Cloudflare Universal SSL CAA records incorrectly override user-defined CAA records
- •The vulnerability allows for potential issuance of unauthorized SSL certificates despite restrictive CAA settings
- •Details remain sparse on whether Cloudflare's platform-level validation fully remediates current misconfigurations
Cloudflare Universal SSL infrastructure has been found to supersede user-configured Certification Authority Authorization (CAA) records. This security flaw prevents domain owners from enforcing specific CA restrictions because Cloudflare's global settings take precedence during the issuance process. Unlike standard certificate management where user policies are authoritative, this implementation creates an unintended bypass. Whether this architectural default has led to widespread unauthorized certificate issuance remains an open question for security auditors.
Sources
Topics
Get the story before everyone else.
1-minute briefings. Zero noise. Straight to your inbox.
Join 1,200+ readers
Discussion
No comments yet. Be the first to start the conversation!