Tink-go (tink-crypto/tink-go) through 2.8.0 contains an input-validation vulnerability where keyset.NewHandleWithNoSecrets() and ReadWithNoSecrets() skip the structural Validate() step before constructing a keyset.Handle, allowing malformed public or no-secret keysets that violate Tink's keyset invariants to be accepted. Attackers can supply a malformed keyset, such as one with an enabled public key lacking a valid primary key or a DESTROYED key with no KeyData, causing inconsistent downstream validation where functions like jwt.JWKSetFromPublicKeysetHandle() process the invalid handle and produce a JWK set, potentially misleading applications that rely on successful handle construction as proof of keyset integrity.

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation poc

Automatable yes

Technical Impact partial

Affected Vendors & Products

Vendors Products
Google
  • Tink Go
Tink-crypto
  • Tink-go

No data.

No data.

References
Link Providers
https://github.com/tink-crypto/tink-go/issues/68 cve-icon cve-icon
https://www.vulncheck.com/advisories/tink-go-keyset-validation-bypass-via-newhandlewithnosecrets cve-icon cve-icon
History

Tue, 27 Oct 2026 04:30:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google tink Go
CPEs cpe:2.3:a:google:tink_go:*:*:*:*:*:*:*:*
Vendors & Products Google
Google tink Go

Tue, 13 Oct 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 13 Oct 2026 07:45:00 +0000

Type Values Removed Values Added
First Time appeared Tink-crypto
Tink-crypto tink-go
Vendors & Products Tink-crypto
Tink-crypto tink-go

Mon, 12 Oct 2026 20:00:00 +0000

Type Values Removed Values Added
Description Tink-go (tink-crypto/tink-go) through 2.8.0 contains an input-validation vulnerability where keyset.NewHandleWithNoSecrets() and ReadWithNoSecrets() skip the structural Validate() step before constructing a keyset.Handle, allowing malformed public or no-secret keysets that violate Tink's keyset invariants to be accepted. Attackers can supply a malformed keyset, such as one with an enabled public key lacking a valid primary key or a DESTROYED key with no KeyData, causing inconsistent downstream validation where functions like jwt.JWKSetFromPublicKeysetHandle() process the invalid handle and produce a JWK set, potentially misleading applications that rely on successful handle construction as proof of keyset integrity.
Title Tink-go 2.8.0 Keyset Validation Bypass via NewHandleWithNoSecrets
Weaknesses CWE-1286
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N'}
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published: 2026-10-12T19:55:37.215Z

Updated: 2026-11-08T14:00:48.625Z

Reserved: 2026-10-12T15:52:36.681Z

Link: CVE-2026-109425

cve-icon Vulnrichment

Updated: 2026-10-13T15:03:47.340Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-12T20:17:09.293

Modified: 2026-10-16T18:14:51.460

Link: CVE-2026-109425

cve-icon Redhat

No data.