CVE-2026-50578

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-50578", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-04T21:34:34.427Z", "datePublished": "2026-08-18T16:51:45.177Z", "dateUpdated": "2026-08-18T17:45:53.174Z"}, "containers": {"cna": {"title": "ePA 3.x Integration: TLS Certificate Verification Universally Disabled", "problemTypes": [{"descriptions": [{"cweId": "CWE-295", "lang": "en", "description": "CWE-295: Improper Certificate Validation", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/fbeta-GmbH/ePA3-Service-OpenSource/security/advisories/GHSA-j9m9-pmwv-hwwr", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/fbeta-GmbH/ePA3-Service-OpenSource/security/advisories/GHSA-j9m9-pmwv-hwwr"}, {"name": "https://github.com/fbeta-GmbH/ePA3-Service-OpenSource/pull/9", "tags": ["x_refsource_MISC"], "url": "https://github.com/fbeta-GmbH/ePA3-Service-OpenSource/pull/9"}, {"name": "https://github.com/fbeta-GmbH/ePA3-Service-OpenSource/commit/0d94a76aa4d57a849f0c18fb3d6d337ec2505170", "tags": ["x_refsource_MISC"], "url": "https://github.com/fbeta-GmbH/ePA3-Service-OpenSource/commit/0d94a76aa4d57a849f0c18fb3d6d337ec2505170"}, {"name": "https://github.com/fbeta-GmbH/ePA3-Service-OpenSource/releases/tag/1.3.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/fbeta-GmbH/ePA3-Service-OpenSource/releases/tag/1.3.0"}, {"name": "https://www.machinespirits.de/advisory/4b68b0", "tags": ["x_refsource_MISC"], "url": "https://www.machinespirits.de/advisory/4b68b0"}], "affected": [{"vendor": "fbeta-GmbH", "product": "ePA3-Service-OpenSource", "versions": [{"version": "< 1.3.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-18T16:51:45.177Z"}, "descriptions": [{"lang": "en", "value": "ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany's electronic patient record. Prior to 1.3.0, ePA 3.x Integration disables TLS certificate verification for both ePA connections in app/vau/VAUProtokoll.py and Konnektor connections in app/konnektor/Konnektor.py. A network-positioned attacker can present an arbitrary certificate, terminate the TLS connection, and intercept ePA traffic. The VAU protocol does not provide an effective fallback because its application-layer certificate validation is also broken in affected versions. The Konnektor session uses self.session.verify set to False while the client authenticates with self.session.cert, so an attacker impersonating the Konnektor can receive the client's mutual TLS certificate exchange and observe smartcard operations. This issue is fixed in version 1.3.0."}], "source": {"advisory": "GHSA-j9m9-pmwv-hwwr", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-18T17:44:33.357494Z", "id": "CVE-2026-50578", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-18T17:45:53.174Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-50578", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-18T17:44:33.357494Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-18T17:44:34.557Z"}}], "cna": {"title": "ePA 3.x Integration: TLS Certificate Verification Universally Disabled", "source": {"advisory": "GHSA-j9m9-pmwv-hwwr", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "fbeta-GmbH", "product": "ePA3-Service-OpenSource", "versions": [{"status": "affected", "version": "< 1.3.0"}]}], "references": [{"url": "https://github.com/fbeta-GmbH/ePA3-Service-OpenSource/security/advisories/GHSA-j9m9-pmwv-hwwr", "name": "https://github.com/fbeta-GmbH/ePA3-Service-OpenSource/security/advisories/GHSA-j9m9-pmwv-hwwr", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/fbeta-GmbH/ePA3-Service-OpenSource/pull/9", "name": "https://github.com/fbeta-GmbH/ePA3-Service-OpenSource/pull/9", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/fbeta-GmbH/ePA3-Service-OpenSource/commit/0d94a76aa4d57a849f0c18fb3d6d337ec2505170", "name": "https://github.com/fbeta-GmbH/ePA3-Service-OpenSource/commit/0d94a76aa4d57a849f0c18fb3d6d337ec2505170", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/fbeta-GmbH/ePA3-Service-OpenSource/releases/tag/1.3.0", "name": "https://github.com/fbeta-GmbH/ePA3-Service-OpenSource/releases/tag/1.3.0", "tags": ["x_refsource_MISC"]}, {"url": "https://www.machinespirits.de/advisory/4b68b0", "name": "https://www.machinespirits.de/advisory/4b68b0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany's electronic patient record. Prior to 1.3.0, ePA 3.x Integration disables TLS certificate verification for both ePA connections in app/vau/VAUProtokoll.py and Konnektor connections in app/konnektor/Konnektor.py. A network-positioned attacker can present an arbitrary certificate, terminate the TLS connection, and intercept ePA traffic. The VAU protocol does not provide an effective fallback because its application-layer certificate validation is also broken in affected versions. The Konnektor session uses self.session.verify set to False while the client authenticates with self.session.cert, so an attacker impersonating the Konnektor can receive the client's mutual TLS certificate exchange and observe smartcard operations. This issue is fixed in version 1.3.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-295", "description": "CWE-295: Improper Certificate Validation"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-18T16:51:45.177Z"}}}, "cveMetadata": {"cveId": "CVE-2026-50578", "state": "PUBLISHED", "dateUpdated": "2026-08-18T17:45:53.174Z", "dateReserved": "2026-06-04T21:34:34.427Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-18T16:51:45.177Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "ePA3-Service-OpenSource", "vendor": "fbeta-GmbH", "versions": [{"status": "affected", "version": "< 1.3.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany's electronic patient record. Prior to 1.3.0, ePA 3.x Integration disables TLS certificate verification for both ePA connections in app/vau/VAUProtokoll.py and Konnektor connections in app/konnektor/Konnektor.py. A network-positioned attacker can present an arbitrary certificate, terminate the TLS connection, and intercept ePA traffic. The VAU protocol does not provide an effective fallback because its application-layer certificate validation is also broken in affected versions. The Konnektor session uses self.session.verify set to False while the client authenticates with self.session.cert, so an attacker impersonating the Konnektor can receive the client's mutual TLS certificate exchange and observe smartcard operations. This issue is fixed in version 1.3.0."}, {"lang": "es", "value": "La Integraci\u00f3n de ePA 3.x implementa el flujo de trabajo de autorizaci\u00f3n y escribe Objetos de Informaci\u00f3n M\u00e9dica en el registro electr\u00f3nico de pacientes de Alemania. Antes de la versi\u00f3n 1.3.0, la Integraci\u00f3n de ePA 3.x deshabilita la verificaci\u00f3n de certificados TLS tanto para las conexiones ePA en app/vau/VAUProtokoll.py como para las conexiones Konnektor en app/konnektor/Konnektor.py. Un atacante posicionado en la red puede presentar un certificado arbitrario, terminar la conexi\u00f3n TLS e interceptar el tr\u00e1fico ePA. El protocolo VAU no proporciona una alternativa efectiva porque su validaci\u00f3n de certificados a nivel de aplicaci\u00f3n tambi\u00e9n est\u00e1 rota en las versiones afectadas. La sesi\u00f3n Konnektor utiliza self.session.verify establecido en False mientras el cliente se autentica con self.session.cert, por lo que un atacante que suplante al Konnektor puede recibir el intercambio de certificados TLS mutuo del cliente y observar las operaciones de la tarjeta inteligente. Este problema est\u00e1 solucionado en la versi\u00f3n 1.3.0."}], "id": "CVE-2026-50578", "lastModified": "2026-10-22T22:10:00.250", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-50578", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-18T17:44:33.357494Z", "version": "2.0.3"}}]}, "published": "2026-08-18T17:16:58.933", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/fbeta-GmbH/ePA3-Service-OpenSource/commit/0d94a76aa4d57a849f0c18fb3d6d337ec2505170"}, {"source": "security-advisories@github.com", "url": "https://github.com/fbeta-GmbH/ePA3-Service-OpenSource/pull/9"}, {"source": "security-advisories@github.com", "url": "https://github.com/fbeta-GmbH/ePA3-Service-OpenSource/releases/tag/1.3.0"}, {"source": "security-advisories@github.com", "url": "https://github.com/fbeta-GmbH/ePA3-Service-OpenSource/security/advisories/GHSA-j9m9-pmwv-hwwr"}, {"source": "security-advisories@github.com", "url": "https://www.machinespirits.de/advisory/4b68b0"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-295"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.3.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "ePA3-Service-OpenSource", "source": "cna", "vendor": "fbeta-GmbH"}, "product": "epa3-service-opensource", "vendor": "fbeta-gmbh"}], "created": "2026-08-18T18:45:03.368895+00:00", "updated": "2026-08-21T12:33:00.504411+00:00", "vendors": ["fbeta-gmbh", "fbeta-gmbh$PRODUCT$epa3-service-opensource"]}