ETK-2026-608

validated

GHSA-c75c-3cmm-48h7 ↗

check availablenot proven exploitable

awaiting cvepublic pockev

other:cosmian_kms_server <= 5.27.1

fixed in 5.28.0

CWE-863 Incorrect Authorization

ETK-2026-608, no cve assigned

cvss7.0ethiack provisional

−16dTTV

21mAI analysis

Check if you are vulnerable

timeline

0 = cve.org, not yet published

trigger signal −20dcheck available−16dagent stopped

−15d

−10d

−5d

description

cosmian_kms_server versions before 5.28.0 can authorize an identity with only Get permission to alter a sensitive key's protection attribute. That identity may then retrieve plaintext key material; exploitation requires a Get grant on the affected key.

mitigation

Upgrade cosmian_kms_server to version 5.28.0 or later. Until the upgrade is complete, restrict Get grants on sensitive keys to identities trusted to access their key material.

fixed in 5.28.0

check

available

exploit

automation

deterministic

auth required

–

EPSS

–

agent run time

21m

cve.org record, t = 0

not published yet

Δ to public poc

–

Δ to kev

–

outcome

Check only, differential: the check fires on the vulnerable build and is silent on the patched one.

source signals

Public signals that triggered or updated the pipeline. These are inputs for the deltas above.

2026-10-01 15:34Z
ghsa: trigger signal, started the run
https://github.com/Cosmian/kms/security/advisories/GHSA-c75c-3cmm-48h7

this entry in the feed

GET /api/v1/feed/ETK-2026-608

{
  "etk_id": "ETK-2026-608",
  "cve_id": null,
  "display_id": "ETK-2026-608",
  "ghsa_id": "GHSA-c75c-3cmm-48h7",
  "euvd_id": null,
  "status": "published",
  "anchor_state": "awaiting_cve",
  "title": "Authorization bypass exposes sensitive keys in cosmian_kms_server",
  "summary": "cosmian_kms_server versions before 5.28.0 can authorize an identity with only Get permission to alter a sensitive key's protection attribute. That identity may then retrieve plaintext key material; exploitation requires a Get grant on the affected key.",
  "mitigation": "Upgrade cosmian_kms_server to version 5.28.0 or later. Until the upgrade is complete, restrict Get grants on sensitive keys to identities trusted to access their key material.",
  "vendor": "other",
  "product": "other:cosmian_kms_server",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "<= 5.27.1"
      ],
      "ecosystem": "other",
      "fixed_versions": [
        "5.28.0"
      ],
      "package_name": "cosmian_kms_server",
      "purl": null
    }
  ],
  "cwes": [
    863
  ],
  "cvss_score": 7,
  "cvss_src": "ethiack_provisional",
  "cvss_vector": null,
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 21.042860366666666,
  "t0_at": null,
  "signals": {
    "check": {
      "at": "2026-10-05T01:30:10.080865+00:00",
      "days": -16.178657673530093,
      "is_lower_bound": true,
      "measured_at": "2026-10-21T05:47:26.125046+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-01T15:34:34+00:00",
      "days": -19.592269720578702,
      "is_lower_bound": true,
      "measured_at": "2026-10-21T05:47:26.125046+00:00",
      "url": "https://github.com/Cosmian/kms/security/advisories/GHSA-c75c-3cmm-48h7"
    }
  }
}

published 2026-10-05 01:09Z
last change 2026-10-21 05:31Z

Need the technical details behind an entry?

Every entry here shows what we attempted and when. The technical details, the generated exploit that fired it and the evidence behind the verdict are not public. Tell us about your use case and we’ll get back to you about extended API access.