AZL-112505: CVE-2026-118774 affecting package python-tensorboard 2.16.2-6

Q: What security control can this issue bypass?

It can bypass policies that require a certificate's declared RSASSA-PSS signature scheme. A child certificate labeled RSASSA-PSS may be accepted when its signature actually uses PKCS#1 v1.5, if the issuer uses PKCS#1 v1.5.

Q: Can this be used to forge a certificate identity?

No. Exploitation still requires a signature produced with the trusted issuer's private key, so the issue does not permit certificate identity forgery.

Q: What version fixes the issue?

The issue is fixed in Forge, also called node-forge, version 1.4.1.

Published Oct 29, 2026

Updated

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used certificate.verify(child), verifySignature(), lib/x509.js to process the relevant input or security decision. node-forge selected RSA padding and RSASSA-PSS parameters from the issuer certificate rather than the child certificate being verified. A child labeled as RSASSA-PSS could therefore be accepted with a PKCS#1 v1.5 signature when the issuer used PKCS#1 v1.5. The signature still had to be produced with the trusted issuer's private key, so this did not permit certificate identity forgery, but it could bypass policies that require a declared signature scheme. This issue is fixed in version 1.4.1.

Affected Software

1 affected component

azure-linux/python-tensorboard<=2.16.2-6

Event History

Oct 29, 2026

Advisory Published

via OSV·07:17 PM

Data Sourced

via OSV·07:17 PM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-118774

Frequently Asked Questions

What security control can this issue bypass?

It can bypass policies that require a certificate's declared RSASSA-PSS signature scheme. A child certificate labeled RSASSA-PSS may be accepted when its signature actually uses PKCS#1 v1.5, if the issuer uses PKCS#1 v1.5.

Can this be used to forge a certificate identity?

No. Exploitation still requires a signature produced with the trusted issuer's private key, so the issue does not permit certificate identity forgery.

What version fixes the issue?

The issue is fixed in Forge, also called node-forge, version 1.4.1.

AZL-112505: CVE-2026-118774 affecting package python-tensorboard 2.16.2-6

Affected Software

Event History

Child vulnerabilities

Frequently Asked Questions

What security control can this issue bypass?

Can this be used to forge a certificate identity?

What version fixes the issue?

Company

Resources

Contact

Frequently Asked Questions

What security control can this issue bypass?

Can this be used to forge a certificate identity?

What version fixes the issue?