CVE-2026-25827: Keyfactor Keyfactor SignServer vulnerability
An issue was discovered in Keyfactor SignServer before 7.6.0. A number of properties were identified to not have any restrictions to what path they can be set to by an admin user. Setting these properties to specific file paths can reveal information to the client side. Three specific properties were identified: The property ATTRIBUTESFILE in PKCS11CryotoToken can be set to a readable but not an accepted (i.e., recognized with attributes) file. In this case an error is thrown, confirming the existence of the file. The property KEYSTOREPATH in KeyStoreCryptoToken can be set to a non-existing file that will return an error confirming to the client side that the file does not exist. The property TRUSTSTOREPATH in RenewalWorker can be set to any path (without any restrictions) by an admin user. In the case that the provided path points to an existing file, readable by the user running the application server, but is not a recognized PEM format, it returns this as an error to the client side, confirming the existences of the file.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Keyfactor SignServerto a version that resolves this vulnerability.Fixed in 7.6.0 - Upgrade
Upgrade
Keyfactor SignServerto a version that resolves this vulnerability.Fixed in before 7.6.0 - Configuration
Restrict KEYSTOREPATH to approved keystore file locations and only allow recognized PEM keystore files; do not allow arbitrary filesystem paths that can be set to non-existent/unrecognized files to trigger client-visible error messages.
Keyfactor SignServer / KeyStoreCryptoToken KEYSTOREPATH = a non-sensitive, recognized/appropriate PEM keystore file path (ensure the admin cannot set arbitrary paths) - Configuration
Restrict TRUSTSTOREPATH to approved truststore file locations and only allow recognized PEM truststore files; prevent unrestricted path setting that can disclose file existence/readability through error responses.
Keyfactor SignServer / RenewalWorker TRUSTSTOREPATH = a non-sensitive, recognized/appropriate PEM truststore file path (ensure the admin cannot set arbitrary paths) - Configuration
Restrict ATTRIBUTESFILE to readable files with accepted/recognized attributes so admins cannot point to readable but unaccepted files that generate client-visible error details.
Keyfactor SignServer / PKCS11CryotoToken ATTRIBUTESFILE = a readable, accepted/recognized PKCS#11 attributes file path
Event History
Frequently Asked Questions
Who can exploit this issue?
An administrator who can set the affected properties can trigger the information disclosure. The relevant paths are processed by the application server, so exposure is limited to files readable by the user running that server.
What information can an attacker obtain?
The issue allows file-existence enumeration rather than disclosure of file contents. Error responses can confirm whether selected paths exist, or in one case confirm that a specified path does not exist.
Which components and settings are involved?
The affected settings are ATTRIBUTESFILE in PKCS11CryotoToken, KEYSTOREPATH in KeyStoreCryptoToken, and TRUSTSTOREPATH in RenewalWorker. The behaviors differ by setting: ATTRIBUTESFILE and TRUSTSTOREPATH can confirm readable existing files through errors, while KEYSTOREPATH can confirm a non-existing file through an error.
What versions are affected?
Keyfactor SignServer versions before 7.6.0 are affected.