CVE-2026-35467: Private Key stored as extractable in browser IndexeDB
Published Apr 2, 2026
·Updated
The stored API keys in temporary browser client is not marked as protected allowing for JavScript console or other errors to allow for extraction of the encryption credentials.
Affected Software
1 affected component
cmu Cveclient<1.0.24
Remediation
Patch Available
Event History
Apr 2, 2026
CVE Published
via MITRE·08:27 PM
Data Sourced
via MITRE·08:27 PM
DescriptionWeakness
Data Sourced
via NVD·09:16 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2026-35467?
CVE-2026-35467 has a severity rating of high, with a CVSS score of 7.5.
2
How do I fix CVE-2026-35467?
The recommended fix for CVE-2026-35467 is to apply the available patch.
3
What does CVE-2026-35467 affect?
CVE-2026-35467 affects the cmu Cveclient software where private keys are stored extractably in browser IndexedDB.
4
Why is CVE-2026-35467 considered a security risk?
CVE-2026-35467 is a security risk because private keys can be extracted through the JavaScript console due to improper storage protections.
5
When was CVE-2026-35467 published?
CVE-2026-35467 was published on April 2, 2026.