Is CVE-2026-89313 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-89313 being exploited in the wild.

How severe is CVE-2026-89313?

Informational severity, published 23 October 2026.

Which products and versions are affected?

Eclipse KeyPont Gose 0.7.5 through 1.0.0-rc3 (ThalesGroup/gose: 0.7.5 through 0.13.0-rc1).

How is CVE-2026-89313 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-89313?

Check whether you run Eclipse KeyPont Gose at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-89313: eclipse-keypont gose JwksTrustStore.Get returns wrong key on absent kid

CVE-2026-89313 · Severity: info · Published 2026-10-23

eclipse-keypont's gose library parses JSON Web Key Sets (JWKS) to validate cryptographic tokens in security workflows. A bug causes the library to return the last key in the set when a requested key ID is absent, instead of reporting "not found"—enabling token verification with the wrong key during key rotation scenarios.

Technologies: Eclipse KeyPont Gose. Vendors: Eclipse KeyPont.

Quick answers

Is CVE-2026-89313 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-89313 being exploited in the wild.
How severe is CVE-2026-89313?: Informational severity, published 23 October 2026.
Which products and versions are affected?: Eclipse KeyPont Gose 0.7.5 through 1.0.0-rc3 (ThalesGroup/gose: 0.7.5 through 0.13.0-rc1).
Is there a fix for CVE-2026-89313?: Yes: fixed in eclipse-keypont gose 1.0.0-rc4 and later. Until then: Callers using TrustStore.Get directly should verify that the returned key's Kid() matches the one requested before use, treating a mismatch as "not found". Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-89313 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-89313?: Check whether you run Eclipse KeyPont Gose at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: eclipse-keypont gose 1.0.0-rc4 and later

Callers using TrustStore.Get directly should verify that the returned key's Kid() matches the one requested before use, treating a mismatch as "not found".

Technical details

A Go library function `JwksTrustStore.Get` uses a named return value that inadvertently retains the last parsed key from a loop. When the requested kid is not found in the refreshed cache, a naked return statement returns this stale key with a nil error instead of nil. The bug affects applications directly calling the exported Get method or using the TrustStore interface; cryptographic signature verification still occurs, but against an unintended key—breaking key rotation semantics and enabling key confusion.

Affected products

eclipse-keypont gose 0.7.5 through 1.0.0-rc3 (ThalesGroup/gose: 0.7.5 through 0.13.0-rc1)

Timeline

2026-09-01: disclosed
2026-10-23: advisory

References

https://github.com/eclipse-keypont/gose/security/advisories/GHSA-v7r8-g6h9-99vv

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.