Talk:Cloudflare

Archives (Index)

2013 2014 2017 2018 2019 2020 2021 2022 2023 2024 2025

This page is archived by ClueBot III.

Revised COI edit request: CVE-2026-14440

Disclosure: I am David Osipov, the independent researcher credited in the CVE-2026-14440 record and the author of one of the technical sources proposed below. I therefore have a conflict of interest and am requesting review rather than editing the article directly.

This supersedes my earlier request, which could not be reviewed because the relationship between individual statements and their supporting references was considered unclear. In this revised proposal, every claim is followed immediately by the sources supporting it.

• Requested change: After the existing “ACME WAF bypass” subsection in the “Outages and issues” section, add the following subsection:

=== Universal SSL CAA issue ===

In July 2026, CVE-2026-14440 was published for a vulnerability in Cloudflare Universal SSL reported by independent researcher David Osipov. Cloudflare's authoritative DNS served an automatically managed CAA record set at query time that superseded stricter CAA records configured by the domain owner. Consequently, RFC 8657 account-binding and validation-method-binding restrictions were not enforced end-to-end. Under non-trivial attack conditions, the issue could allow an attacker to obtain a browser-trusted TLS certificate, potentially enabling a man-in-the-middle attack.

• Reason for the change: This would add a concise, product-specific security issue to the existing “Outages and issues” section. The wording does not claim active exploitation, a confirmed breach, or an effect on all Cloudflare customers.

The proposed references distinguish between their respective roles:

• The CVE Program and NVD records support the existence, scope, technical description, impact conditions, and researcher attribution.
• DonWeb News provides third-party coverage of the vulnerability.
• My own technical analysis is offered only as a primary technical disclosure, not as an independent source establishing the vulnerability's importance or suitability for inclusion. The NVD record also lists this analysis among the references added by CISA-ADP.

Because I authored and host the technical analysis, I understand that an uninvolved editor may decide to omit it, replace it, or use it only for limited technical details.

References

--David Osipov (talk) 10:10, 21 July 2026 (UTC)

Proposed short addition about CVE-2026-14440 / Universal SSL CAA issue

Extended content

Disclosure: I am David Osipov, the independent researcher credited in CVE-2026-14440. Because of this conflict of interest, I am not adding the text directly to the article. I would like uninvolved editors to review whether a short, neutral addition is appropriate.

The current article is about Cloudflare, Inc. and already has an “Outages and issues” section, including an “ACME WAF bypass” subsection. I think CVE-2026-14440 may fit there as a short security-issue entry, because it concerns Cloudflare Universal SSL and is publicly tracked by NVD, the CVE Program, GitHub Advisory Database, and CISA enrichment data. I am not proposing a separate article or a long section.

• Requested location: Please add the following subsection under “Outages and issues”, preferably near the existing “ACME WAF bypass” subsection.

Text to add:

Universal SSL CAA issue

In July 2026, CVE-2026-14440 was published for an issue in Cloudflare Universal SSL. The issue involved CAA records, which are DNS records that help determine which certificate authorities may issue TLS certificates for a domain. According to NVD, in some Universal SSL configurations Cloudflare’s authoritative DNS could serve automatically managed CAA records instead of stricter CAA records configured by the domain owner. As a result, RFC 8657 restrictions such as accounturi and validationmethods, which can bind certificate issuance to a specific account or validation method, might not be enforced end-to-end. Successful exploitation could allow issuance of a browser-trusted TLS certificate and enable a man-in-the-middle attack, although exploitation was described as non-trivial. The NVD record credits independent researcher David Osipov with reporting the issue.

• Optional additional sentence, if editors think mitigation context is useful:

Cloudflare’s documented workaround for strict RFC 8657 enforcement was to disable Universal SSL on the affected zone; Cloudflare’s documentation warns that customers should have another valid edge certificate, such as a custom certificate or Advanced Certificate Manager certificate, before disabling Universal SSL to avoid TLS errors.

Reason for the change:

• The issue has an official CVE identifier and is listed by NVD and GitHub Advisory Database.
• It concerns a Cloudflare product/function, Universal SSL, rather than only a third-party configuration.
• The proposed text is short and avoids claims of active exploitation, breach, or impact on all Cloudflare customers.
• The proposed wording does not claim that all Cloudflare customers are affected.
• I have intentionally not cited my own website in the proposed article text. If editors think a primary technical write-up is useful as background, I can provide it separately, but I agree that independent or official sources should carry the main article claim.

References supporting the change:

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-14440
• GitHub Advisory Database: https://github.com/advisories/GHSA-vrv9-rjp4-w93c
• CVE Record: https://www.cve.org/CVERecord?id=CVE-2026-14440
• RFC 8657: https://www.rfc-editor.org/rfc/rfc8657
• Cloudflare documentation on CAA records: https://developers.cloudflare.com/ssl/edge-certificates/caa-records/
• Cloudflare documentation on disabling Universal SSL: https://developers.cloudflare.com/ssl/edge-certificates/universal-ssl/disable-universal-ssl/
• Technical research background, not proposed as an article citation unless editors think it is useful: https://david-osipov.vision/en/blog/cybersecurity/cloudflare-ssl-mitm-flaw-2026/

Open questions for editors:

• Is this sufficiently relevant for a short entry under “Outages and issues”?
• Should the subsection title be “Universal SSL CAA issue”, “Universal SSL CAA vulnerability”, or something else?
• Should the optional mitigation sentence be included, or is it too detailed for the Cloudflare article?
• Should the researcher credit be included, given that it appears in the official vulnerability records, or should the paragraph omit the name to keep the article more focused on Cloudflare?

References

— Preceding unsigned comment added by David Osipov (talk • contribs) 21:07, 7 July 2026 (UTC)

Reply 20-JUL-2026

  Unable to review  

• Your edit request could not be reviewed because it is unclear which references are connected to which claim statements in the text of your proposal. When proposing edit requests it is important to highlight in the text, through the use of ref tags, which specific sources are doing the referencing for each claim. The point of these inline ref tags is to allow the reviewer and readers to check that the material is sourced; that point will be lost if the ref tags are not clearly placed. Note the examples below:

Examples

N  INCORRECT

The Sun's diameter is 864,337 miles, while the Moon's diameter is 2,159 miles. The Sun's temperature is 5,778 Kelvin.

References

---

      1. Sjöblad, Tristan. The Sun. Academic Press, 2019, p. 1.
      2. Harinath, Paramjit. (2019) "Size of the Moon", Science, 51(78):46.
      3. Uemura, Shū. The Sun's Heat. Academic Press, 2019, p. 2.

In the first example above there are three references provided, but the claim statements do not contain ref tags indicating which reference applies where. The references instead have been placed outside of the text, bundled together towards the bottom. Your edit request similarly bundles references together outside of the area of the requested text. These links between material and their source references must be more clearly made, as shown in the next example below:

Y  CORRECT

The Sun's diameter is 864,337.3 miles,<ref>{{cite book|last1=Sjöblad|first1=Tristan|title=The Sun|url=http://www.booksource.com|publisher=Academic Press|date=2020|page=1}}</ref> while the Moon's diameter is 2,159 miles.<ref>{{cite journal|last1=Harinath|first1=Prisha|title=Size of the Moon|journal=Science|issue=78|volume=51|url=http://www.journalsource.com|date=2020|page=46}}</ref> The Sun's temperature is 5,778 Kelvin.<ref>{{cite book|last1=Uemura|first1=Shu|title=The Sun's Heat|url=http://www.websource.com|publisher=Academic Press|date=2020|page=2}}</ref>

Which displays as:

The Sun's diameter is 864,337.3 miles, while the Moon's diameter is 2,159 miles. The Sun's temperature is 5,778 Kelvin.

References

---

• In the second example above, the links between the provided references and their claim statement ref tags are perfectly clear. Kindly reformulate your edit request so that it aligns more with the second example above, and feel free to re-submit that edit request at your earliest convenience.
• The editor is gently reminded to sign all talk page posts using four tildes ~~~~

Regards,  Spintendo  06:36, 20 July 2026 (UTC)

Dear @Spintendo,

Thank you for the guidelines. I've created a new request and, I hope, It's now properly formatted. If you find an issue there, please let me know.

Thanks again! David Osipov (talk) 10:11, 21 July 2026 (UTC)