4 ms·
There is a nuance here for Cloudflare users that makes this problematic. While analyzing the Jabber.ru incident (which used this exact BGP->TLS vector), I disc
by David_Osipov 9mo ago
There is a nuance here for Cloudflare users that makes this problematic.
While analyzing the Jabber.ru incident (which used this exact BGP->TLS vector), I discovered that Cloudflare's "Universal SSL" actively injects permissive CAA records that override user-defined restrictions.
If a user sets a strict accounturi CAA record (RFC 8657) to lock issuance to their specific account—specifically to prevent BGP hijackers from getting a cert—Cloudflare's system automatically appends a wildcard record alongside it to keep their automation working. Because CAs accept any valid record, this effectively nullifies the protection.
It creates a situation where you think you have mitigated the BGP risk via DNS, but the vendor has silently reopened the door.
I wrote up the technical analysis of this override behavior here: https://david-osipov.vision/en/blog/cybersecurity/cloudflare-ssl-mitm-flaw-2026/ https://david-osipov.vision/en/blog/cybersecurity/cloudflare...