CVE-2025-26787: Medium severity Keyfactor SignServer vulnerability
An error in the SignServer container startup logic was found in Keyfactor SignServer versions prior to 7.2. The Admin CLI command used to configure Certificate access to the initial startup of the container sets a property of "allowany" to allow any user with a valid and trusted client auth certificate to connect. Admins can then set more restricted access to specific certificates. A logic error caused this admin CLI command to be run on each restart of the container instead of only the first startup as intended resetting the configuration to "allowany".
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-26787?
CVE-2025-26787 has been classified as a critical severity vulnerability due to its impact on certificate access control.
How do I fix CVE-2025-26787?
To fix CVE-2025-26787, upgrade your Keyfactor SignServer to version 7.2 or higher.
What systems are affected by CVE-2025-26787?
CVE-2025-26787 affects Keyfactor SignServer versions prior to 7.2.
What is the main issue described in CVE-2025-26787?
The main issue in CVE-2025-26787 is the improper configuration of certificate access allowing any user with a valid client certificate.
What are the consequences of not addressing CVE-2025-26787?
Failure to address CVE-2025-26787 may lead to unauthorized access to the certificate management functionality, jeopardizing certificate security.