CVE-2026-33584

Full vulnerability record from the local CVENow database.

Description

Exposed Keycloak management service in the Arqit Symmetric Key Agreement Platform enables unauthorized access to sensitive debug information such as metrics and health data. This issue affects Symmetric Key Agreement Platform: before 26.03.

Severity

MEDIUM

CVSS score

5.3 (v3.1)

Vulnerability status

Deferred

Source identifier

a6d3dc9e-0591-4a13-bce7-0f5b31ff6158

Published

2026-05-13 19:17:07.183000

Last modified

2026-10-26 17:10:03.270000

View original CVE JSON

{
  "id": "CVE-2026-33584",
  "sourceIdentifier": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
  "published": "2026-05-13T19:17:07.183",
  "lastModified": "2026-10-26T17:10:03.270",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Exposed Keycloak management \nservice in the Arqit Symmetric Key Agreement Platform enables unauthorized access to sensitive debug \ninformation such as metrics and\n health data. This issue affects Symmetric Key Agreement Platform: before 26.03."
    },
    {
      "lang": "es",
      "value": "El servicio de gestión de Keycloak expuesto en la Plataforma de Acuerdo de Claves Simétricas de Arqit permite el acceso no autorizado a información de depuración sensible, como métricas y datos de estado. Este problema afecta a la Plataforma de Acuerdo de Claves Simétricas: anterior a la versión 26.03."
    }
  ],
  "affected": [
    {
      "source": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
      "affectedData": [
        {
          "vendor": "Arqit",
          "product": "Symmetric Key Agreement Platform",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0",
              "lessThan": "26.03",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-13T19:37:59.672987Z",
          "id": "CVE-2026-33584",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-749"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://www.cvcn.gov.it/cvcn/cve/CVE-2026-33584",
      "source": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"
    }
  ]
}