{"id":"CVE-2026-115408","kind":"vulnerability","aliases":["CVE-2026-115408"],"related":[],"title":"crypto11 Go library: ML-KEM key lookup can return the wrong public key","description":"In `github.com/eclipse-keypont/crypto11/v2` versions `>= 2.0.0-rc3, <= 2.0.0-rc8`, the ML-KEM key-pair lookup functions (`FindMLKEMKeyPair`, `FindMLKEMKeyPairs`, `FindMLKEMKeyPairsWithAttributes`) locate the public half of an ML-KEM key pair by `CKA_ID`/`CKA_LABEL` and never verify it against the private key. In addition, the \"ID only\" fallback search runs even when the private key has no `CKA_ID`, so the search template reduces to the public-key class and the ML-KEM key type and the first ML-KEM public key on the token is returned. `Encapsulate()` on the resulting key pair encrypts the fresh shared secret to that key, so its owner — not the holder of the private key the caller looked up — can recover the secret. An attacker who can open an unauthenticated session on the token and plant a public `CKK_ML_KEM` object carrying the victim's `CKA_ID`/`CKA_LABEL` receives the shared secrets for encapsulations performed through the substituted key pair, compromising the confidentiality of those secrets and of everything protected by keys derived from them. The v1 module paths have no ML-KEM support and are not affected.","summary":"The Go library github.com/eclipse-keypont/crypto11/v2 finds an ML-KEM public key by label or ID without checking it matches the private key, and falls back to returning the first ML-KEM public key on the token when no ID is set. An attacker who can plant a public ML-KEM object on the token can get shared secrets from encapsulations that were meant for the victim's key.","severity":"medium","cvss":5.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["go","ml-kem","package","pkcs11","post-quantum"],"not_affected_if":["authenticated-token-only","no-ml-kem","v1-module"],"how_to_check":"- Check the version of `github.com/eclipse-keypont/crypto11/v2` in `go.mod` (look for `require github.com/eclipse-keypont/crypto11/v2 v2.0.0-rc...`).\n- Search the code for calls to `FindMLKEMKeyPair`, `FindMLKEMKeyPairs` or `FindMLKEMKeyPairsWithAttributes`.\n- Confirm whether the module is the v2 path; v1 paths are not affected.","fix":"- Upgrade `github.com/eclipse-keypont/crypto11/v2` to a version above `2.0.0-rc8` (the fixed version number is unknown from the sources).\n- Until upgraded, avoid ML-KEM key lookup by label or ID on tokens that untrusted parties can open unauthenticated sessions on.","status":"open","published_at":"2026-10-27T12:17:07+00:00","first_seen_at":"2026-10-27T12:31:37+00:00","triaged_at":"2026-10-27T12:32:11+00:00","updated_at":"2026-10-27T12:32:11+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-27T12:32:11Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `github.com/eclipse-keypont/crypto11/v2` to a version above `2.0.0-rc8` (the fixed version number is unknown from the sources).\n- Until upgraded, avoid ML-KEM key lookup by label or ID on tokens that untrusted parties can open unauthenticated sessions on.","reach":"local","title":"crypto11 Go library: ML-KEM key lookup can return the wrong public key","impact":"high","summary":"The Go library github.com/eclipse-keypont/crypto11/v2 finds an ML-KEM public key by label or ID without checking it matches the private key, and falls back to returning the first ML-KEM public key on the token when no ID is set. An attacker who can plant a public ML-KEM object on the token can get shared secrets from encapsulations that were meant for the victim's key.","category":"package","nicknames":[],"who_cares":["go","pkcs11","ml-kem","post-quantum"],"confidence":0.7,"needs_auth":"no","worst_case":"attacker receives shared secrets meant for the victim's ML-KEM key","analyst_note":"Check the NVD entry and the upstream repository for the fixed version number and whether an authenticated-session requirement changes exposure.","how_to_check":"- Check the version of `github.com/eclipse-keypont/crypto11/v2` in `go.mod` (look for `require github.com/eclipse-keypont/crypto11/v2 v2.0.0-rc...`).\n- Search the code for calls to `FindMLKEMKeyPair`, `FindMLKEMKeyPairs` or `FindMLKEMKeyPairsWithAttributes`.\n- Confirm whether the module is the v2 path; v1 paths are not affected.","needs_analyst":true,"not_affected_if":["v1-module","no-ml-kem","authenticated-token-only"],"who_is_affected":"Only teams using the v2 module of crypto11 (`>= 2.0.0-rc3, <= 2.0.0-rc8`) for ML-KEM key pairs on a PKCS#11 token. The exposure needs a token that an attacker can write public objects to without logging in. Teams on v1 paths or not using ML-KEM can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000769,"input_tokens":3687,"output_tokens":801,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-115408':17A,20A '-2026':16A,19A '/eclipse-keypont/crypto11/v2':35B,105C '2.0.0':107C,109C 'addit':148C 'affect':294C 'attack':75B,228C 'back':56B 'caller':220C 'carri':246C 'check':48B 'cka':135C,137C,162C,250C,252C 'ckk':242C 'class':174C 'compromis':266C 'confidenti':268C 'crypto11':1A 'cve':15A,18A 'deriv':278C 'encapsul':93B,195C,259C 'encrypt':201C 'even':155C 'everyth':274C 'fall':55B 'fallback':152C 'find':36B 'findmlkemkeypair':120C,121C 'findmlkemkeypairswithattribut':122C 'first':60B,184C 'fresh':203C 'function':119C 'get':89B 'github.com':34B,104C 'github.com/eclipse-keypont/crypto11/v2':33B,103C 'go':2A,21B,31B 'half':126C 'holder':214C 'id':46B,71B,136C,150C,163C,251C 'kem':6A,24B,40B,63B,83B,114C,131C,179C,187C,244C,289C 'key':7A,14A,42B,53B,65B,101B,116C,132C,146C,159C,173C,180C,189C,199C,208C,218C,264C,277C 'key-pair':115C 'label':44B,138C,253C 'librari':3A,32B 'locat':123C 'look':221C 'lookup':8A,118C 'match':50B 'meant':96B 'ml':5A,23B,39B,62B,82B,113C,130C,178C,186C,243C,288C 'ml-kem':4A,22B,38B,61B,81B,112C,129C,177C,185C,287C 'modul':283C 'never':140C 'object':84B,245C 'open':231C 'owner':211C 'packag':25B 'pair':117C,133C,200C,265C 'path':284C 'perform':260C 'pkcs11':26B 'plant':78B,239C 'post':28B 'post-quantum':27B 'privat':52B,145C,158C,217C 'protect':275C 'public':13A,41B,64B,80B,125C,172C,188C,241C 'public-key':171C 'quantum':29B 'rc3':108C 'rc8':110C 'receiv':254C 'recov':224C 'reduc':168C 'result':198C 'return':10A,58B,194C 'run':154C 'search':153C,166C 'secret':91B,205C,226C,257C,271C 'session':234C 'set':73B 'share':90B,204C,256C 'substitut':263C 'support':290C 'templat':167C 'token':68B,87B,192C,237C 'type':181C 'unauthent':233C 'v1':282C 'verifi':141C 'version':106C 'victim':99B,248C 'without':47B 'wrong':12A","nicknames":[],"mitigations":[],"who_affected":"Only teams using the v2 module of crypto11 (`>= 2.0.0-rc3, <= 2.0.0-rc8`) for ML-KEM key pairs on a PKCS#11 token. The exposure needs a token that an attacker can write public objects to without logging in. Teams on v1 paths or not using ML-KEM can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T12:17:07+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"emo@eclipse.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115408","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115408","severity":null,"published_at":"2026-10-27T12:17:07+00:00","modified_at":"2026-10-27T12:17:07+00:00","first_seen_at":"2026-10-27T12:31:37+00:00","fetched_at":"2026-10-27T12:31:37+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}