# CVE-2026-33583: Arqit Symmetric Key Agreement Platform sensitive key exposure

Source: https://junglewise.ai/threats/cve-2026-33583-arqit-symmetric-key-agreement-platform-sensitive-key-exposure  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-13. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

CVE-2026-33583 · Severity: high · CVSS 8.7 · Published 2026-05-13

The Arqit Symmetric Key Agreement Platform, which manages secure cryptographic keys for device registration, contains a vulnerability that exposes sensitive security keys. An attacker can access these keys without a password because they are transmitted over an insecure, unencrypted connection. This could allow an unauthorized party to intercept internal system keys and compromise the security of the entire device registration process.

Technologies: [Arqit Symmetric Key Agreement Platform](https://junglewise.ai/threats/technologies/symmetric-key-agreement-platform). Vendors: [Arqit](https://junglewise.ai/threats/vendors/arqit).

## Quick answers

**Is CVE-2026-33583 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-33583 being exploited in the wild.

**How severe is CVE-2026-33583?** High severity, with a CVSS score of 8.7, published 13 May 2026.

**Which products and versions are affected?** Arqit Symmetric Key Agreement Platform before 26.03 (specifically 25.09.x and 25.12).

**Is there a fix for CVE-2026-33583?** A patch was published on 2026-05-13: Version 26.03 identified as the fixed version. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-33583 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-33583?** Check whether you run Arqit Symmetric Key Agreement Platform at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Arqit Symmetric Key Agreement (SKA) Platform exposes a REST API that allows for the retrieval of cryptographic keys from the system database. The vulnerability is classified as an exposed dangerous method (CWE-749) because the 'Qkey' service is accessible via unauthenticated and unencrypted HTTP GET requests. A network-based attacker can exploit this to retrieve the QKEY—used in the 'OTA-Quantum' device registration process—and other internal system keys. While the attack complexity is rated high, successful exploitation results in a complete loss of confidentiality and integrity for the affected cryptographic material. The issue is resolved in version 26.03.

## Affected products

- Arqit Symmetric Key Agreement Platform before 26.03 (specifically 25.09.x and 25.12)

## Timeline

- 2026-05-13: advisory: NVD and ENISA published the vulnerability details.
- 2026-05-13: patched: Version 26.03 identified as the fixed version.

## References

- [https://www.cvcn.gov.it/cvcn/cve/CVE-2026-33583](https://www.cvcn.gov.it/cvcn/cve/CVE-2026-33583)

## Related threats

- [Arqit SKA-Platform improper idle timeout management in Keycloak interface](https://junglewise.ai/threats/cve-2026-33585-arqit-ska-platform-improper-idle-timeout-management-in-keycloak)
- [Arqit Symmetric Key Agreement Platform information disclosure in Keycloak service](https://junglewise.ai/threats/cve-2026-33584-arqit-symmetric-key-agreement-platform-information-disclosure-in)