CVE-2026-25826: Keyfactor Keyfactor SignServer vulnerability
An issue was discovered in Keyfactor SignServer before 7.6.0. The attribute ATTRIBUTESFILE in PKCS11CryptoToken can be set to a readable file but not an accepted file (i.e., recognized with attributes). In this case, an error is thrown which - together with the error - also prints the content of the file to the application server log. This gives a user that has both SignServer admin access and access to read the output of the server log (i.e., if remote syslog shipping is configured), the possibility to read the content of files accessible by the local user JBoss.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Keyfactor SignServerto a version that resolves this vulnerability.Fixed in 7.6.0 - Compensating control
If remote syslog shipping is configured and untrusted users may read server logs, restrict access so that only authorized personnel can view Keyfactor SignServer application server logs.
Event History
Frequently Asked Questions
Who can exploit this issue?
Exploitation requires both SignServer administrative access and access to the application server log output. The described example is access through remote syslog shipping; the attacker must be able to read the resulting logged error.
What files could be exposed?
The issue can expose content from files that are readable by the local JBoss user running the application server. The file is selected through the PKCS11CryptoToken ATTRIBUTESFILE attribute and is logged when it is readable but not recognized as an accepted attributes file.
Are deployments affected by default?
The provided information identifies a specific configuration action: setting ATTRIBUTESFILE to a readable file that is not an accepted attributes file. It does not state that this condition exists in a default configuration.
How can I determine whether an instance is affected?
Check whether the SignServer version is earlier than 7.6.0 and whether PKCS11CryptoToken configurations use ATTRIBUTESFILE. Review application-server logs for errors triggered by invalid or unrecognized attributes files, particularly where log output is available to SignServer administrators.