CVE-2026-115693: Custom cacerts or cacertfile do not restrict trust to the pinned CA in hackney

Improper Certificate Validation vulnerability in hackneyssl in benoitc hackney allows an on-path attacker to impersonate a server pinned to a private certificate authority via a certificate chain that ends in a publicly trusted root. hackney adds {partialchain, fun hackneyssl:partialchain/1} to every verifypeer configuration. The callback returns any certificate in the peer chain whose public key matches a root in the bundled certifi store as the trust anchor, and OTP honours that callback over the configured cacerts. hackneyssl:mergesslopts/3 kept the callback when the caller replaced the trust store with cacerts or cacertfile in ssloptions, so a connection pinned to a private CA still accepted any chain that carried a publicly trusted root.

The hostname check still applies, so the attacker needs a publicly trusted certificate for the pinned hostname.

This issue affects hackney: from 1.24.0 before 4.9.0.