Unauthorized Key Lookup Vulnerability in Crypto11 by Eclipse

CVE-2026-115408

What is CVE-2026-115408?

The Crypto11 library in specific versions exhibits a risk due to flawed key-pair lookup processes. The ML-KEM key-pair lookup functions, which should verify the integrity of public key identifiers against private keys, fail to do so. Consequently, an attacker with access to an unauthenticated session can mislead the system into returning a public key associated with a private key that potentially does not belong to them. This vulnerability allows an attacker to compromise the confidentiality of shared secrets derived from the key pairs, exposing sensitive information and allowing unauthorized access to secure data. The issue primarily arises when the lookup functions are executed without proper validation of the corresponding private key.

References