Executive brief
A vulnerability in the cveClient tool, used by security organizations to manage vulnerability records, could allow sensitive API keys to be exposed. The software failed to properly protect encryption keys and stored API keys in a way that could be accessed through a browser's developer console or by malicious scripts. If exploited, an attacker could gain unauthorized access to the CVE management system, potentially allowing them to modify or view sensitive vulnerability data.
Technical details
A vulnerability in CERT/CC cveClient (prior to version 1.0.24) stems from insufficient protection of credentials stored in the browser. The application stored API keys in plaintext within localStorage or sessionStorage before encryption processes were completed. Additionally, RSA private keys were stored as extractable JWK objects in IndexedDB rather than non-extractable CryptoKey objects. An attacker with local access or the ability to execute JavaScript in the context of the browser (e.g., via a separate XSS or console access) could extract these credentials. The fix involves marking keys as non-extractable and ensuring plaintext keys are not persisted before encryption is finalized.
Affected products
- CERT/CC cveClient versions up to (excluding) 1.0.24
Timeline
- 2026-03-31: other: Fix proposed via pull request
- 2026-04-01: patched: Pull request merged into main branch
- 2026-04-02: disclosed: CVE published