The 2023 jabber.ru Attack Exposes a Critical Cloudflare Flaw in 2026

Abstract This article analyzes a critical security vulnerability in Cloudflare's Universal SSL, where the automatic injection of permissive CAA records actively nullifies the IETF standard RFC 8657. By overriding user-defined account binding parameters, this configuration re-opens the exact security gap exploited in the 2023 jabber.ru MitM attack, leaving millions of domains vulnerable to BGP hijacking and unauthorized TLS certificate issuance. The analysis demonstrates that this is not a technical oversight but a design choice that neutralizes the `accounturi` and `validationmethods` security controls, and argues that Cloudflare must implement strict ACME account binding to mitigate this risk. TL;DR The Mechanism Cloudflare’s Universal SSL injects permissive CAA records that override user DNS constraints, causing certificate authorities to ignore strict account-binding checks. The Risk This enables BGP hijacking and network interception to obtain unauthorized TLS certificates by bypassing accounturi and validationmethods. The Precedent The configuration replicates the gap exploited in the 2023 jabber.ru MitM, where intercepted traffic satisfied http-01 validation challenges. The Mitigation Cloudflare must stop overriding user DNS records or fully implement RFC 8657 to restrict certificate issuance to the domain owner’s authorized ACME account. UPDATE (January 2026): The Venezuela Confirmation In January 2026, a massive BGP leak involving Venezuela’s state-owned ISP (CANTV, AS8048) made global headlines. In their analysis of the incident, Cloudflare explicitly stated that “BGP route leaks happen all of the time, and they have always been part of the Internet.” [1a] This admission highlights exactly why the security gap described in this article is so critical. If BGP leaks are “common” (whether accidental or malicious), then the network layer cannot be trusted for domain validation. Yet, as detailed below, Cloudflare’s Universal SSL default configuration actively disables the specific IETF standard (RFC 8657) designed to prevent these common BGP leaks from being weaponized to issue fraudulent certificates. I have opened a new discussion on this specific contradiction with the Cloudflare team. By David Osipov ISNI: 0000 0005 1802 960X ORCID: 0009-0005-2713-9242 VIAF: 139173726847611590332 Wikidata: Q130604188