The 2023 jabber.ru Attack Exposes a Critical Cloudflare Flaw in 2026

Abstract This article analyzes a critical security vulnerability in Cloudflare's Universal SSL, where the automatic injection of permissive CAA records actively nullifies the IETF standard RFC 8657. By overriding user-defined account binding parameters, this configuration re-opens the exact security gap exploited in the 2023 jabber.ru MitM attack, leaving millions of domains vulnerable to BGP hijacking and unauthorized TLS certificate issuance. The analysis demonstrates that this is not a technical oversight but a design choice that neutralizes the `accounturi` and `validationmethods` security controls, and argues that Cloudflare must implement strict ACME account binding to mitigate this risk. TL;DR The Mechanism Cloudflare’s Universal SSL injects permissive CAA records that override user DNS constraints, causing certificate authorities to ignore strict account-binding checks. The Risk This enables BGP hijacking and network interception to obtain unauthorized TLS certificates by bypassing accounturi and validationmethods. The Precedent The configuration replicates the gap exploited in the 2023 jabber.ru MitM, where intercepted traffic satisfied http-01 validation challenges. The Mitigation Cloudflare must stop overriding user DNS records or fully implement RFC 8657 to restrict certificate issuance to the domain owner’s authorized ACME account. By David Osipov ISNI: 0000 0005 1802 960X ORCID: 0009-0005-2713-9242 VIAF: 139173726847611590332 Wikidata: Q130604188