ZeroDay Findings
Sign inSign up

Findings

CVE-2026-109425

Tink-go 2.8.0 Keyset Validation Bypass via NewHandleWithNoSecrets

Published Oct 12, 2026 · updated Oct 14, 2026 · tink-crypto tink-go

Tink-go (tink-crypto/tink-go) through 2.8.0 contains an input-validation vulnerability where keyset.NewHandleWithNoSecrets() and ReadWithNoSecrets() skip the structural Validate() step before constructing a keyset.Handle, allowing malformed public or no-secret keysets that violate Tink's keyset invariants to be accepted. Attackers can supply a malformed keyset, such as one with an enabled public key lacking a valid primary key or a DESTROYED key with no KeyData, causing inconsistent downstream validation where functions like jwt.JWKSetFromPublicKeysetHandle() process the invalid handle and produce a JWK set, potentially misleading applications that rely on successful handle construction as proof of keyset integrity.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 12, 2026 · CIRCL Vulnerability Lookup

    Detected

    Tink-go (tink-crypto/tink-go) through 2.8.0 contains an input-validation vulnerability where keyset.NewHandleWithNoSecrets() and ReadWithNoSecrets() skip the structural Validate() step before constructing a keyset.Handle, allowing malformed public or no-secret keysets that violate Tink's keyset invariants to be accepted. Attackers can supply a malformed keyset, such as one with an enabled public k

  2. Oct 14, 2026 · CIRCL Vulnerability Lookup

    Updated

    Tink-go (tink-crypto/tink-go) through 2.8.0 contains an input-validation vulnerability where keyset.NewHandleWithNoSecrets() and ReadWithNoSecrets() skip the structural Validate() step before constructing a keyset.Handle, allowing malformed public or no-secret keysets that violate Tink's keyset invariants to be accepted. Attackers can supply a malformed keyset, such as one with an enabled public k

Affected

  • vendor tink-crypto tink-goversion unspecified

Sources

  • CIRCL Vulnerability LookupVulnerability recordCVE-2026-109425

    Tink-go (tink-crypto/tink-go) through 2.8.0 contains an input-validation vulnerability where keyset.NewHandleWithNoSecrets() and ReadWithNoSecrets() skip the structural Validate() step before constructing a keyset.Handle, allowing malformed public or no-secret keysets that violat

    vulnerability.circl.lu
  • CVE.orgVulnerability recordCVE-2026-109425

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-109425

    30-day exploitation probability 0.2%

    first.org

References