Why SolarWinds Observability Self-Hosted is not affected by CVE-2026-32144, CVE-2026-42791

In 2026, the National Institute of Standards and Technology (NIST) published a security bulletin about NVD-CVE-2026-32144 and NVD-CVE-2026-42791.

CVE-2026-32144 is an OCSP certificate validation vulnerability in Erlang/OTP. This issue affects Erlang/OTP versions from 27.0 up to, but not including, 27.3.4.10 and 28.4.2. The vulnerability allows unauthorized OCSP responder certificates to be accepted without verifying that they were cryptographically signed by the issuing CA, potentially enabling forged OCSP responses that cause revoked certificates to be accepted as valid.

CVE-2026-42791 is an OCSP certificate validation vulnerability in Erlang/OTP. This issue affects Erlang/OTP versions from 27.0 up to, but not including, 27.3.4.12, 28.5.0.1, and 29.0.1. The vulnerability allows OCSP responses signed with an expired responder certificate to be accepted as valid, potentially enabling forged OCSP responses that cause revoked certificates to be accepted as valid.

Although SolarWinds Observability Self-Hosted includes Erlang/OTP version 26.2.5.21, the product is not affected. This OTP version is outside the affected version ranges, and our analysis confirmed that the affected OCSP functionality is not present in the product. Additionally, RabbitMQ does not enable this functionality by default.