CVE-2026-25826 in SignServer
Summary
by MITRE • 09/15/2026
An issue was discovered in Keyfactor SignServer before 7.6.0. The attribute ATTRIBUTESFILE in PKCS11CryptoToken can be set to a readable file but not an accepted file (i.e., recognized with attributes). In this case, an error is thrown which - together with the error - also prints the content of the file to the application server log. This gives a user that has both SignServer admin access and access to read the output of the server log (i.e., if remote syslog shipping is configured), the possibility to read the content of files accessible by the local user JBoss.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/15/2026
The vulnerability identified in Keyfactor SignServer versions prior to 7.6.0 represents a critical information disclosure flaw rooted in improper error handling and insufficient input validation within the PKCS11CryptoToken component. Specifically, the ATTRIBUTESFILE configuration attribute allows administrators to specify a path to an external file containing cryptographic token attributes. While the system is designed to validate that this file contains recognized and accepted attribute formats, it fails to properly sanitize or restrict access when the specified file exists but does not conform to the expected schema. Instead of silently rejecting the invalid input or providing a generic error message, the application logic proceeds to throw an exception that inadvertently includes the raw content of the target file in the stack trace or error log output.
This technical flaw creates a significant security risk by enabling unauthorized data exfiltration under specific privilege conditions. An attacker who has obtained administrative access to SignServer can manipulate the ATTRIBUTESFILE parameter to point toward sensitive files accessible by the underlying JBoss application server user account, such as configuration files containing database credentials, private keys, or other secrets stored on the local filesystem. When this misconfigured attribute is processed, the resulting error message propagates into the standard application logs. If the organization employs remote syslog shipping or any mechanism that aggregates log output to a centralized logging system accessible by lower-privileged users or external entities, the contents of these restricted files are effectively exposed outside the secure boundary of the application server.
From an industry standards perspective, this vulnerability aligns with CWE-209, which describes the generation of error messages containing sensitive information, and CWE-532, concerning insertion of sensitive information into log files. The attack vector leverages administrative privileges to trigger a side-channel effect through logging mechanisms, allowing for data leakage without direct file system read access via standard application endpoints. In terms of MITRE ATT&CK mapping, this behavior facilitates the Discovery phase by enabling an attacker to enumerate and extract local file contents, specifically relating to techniques involving log injection or exploitation of verbose error handling to gather intelligence about the host environment and stored credentials.
To mitigate this vulnerability, organizations running Keyfactor SignServer versions earlier than 7.6.0 must upgrade immediately to version 7.6.0 or later, where the issue has been resolved by implementing stricter input validation and sanitizing log outputs to exclude sensitive file contents during error conditions. Additionally, administrators should review their logging configurations to ensure that application logs do not contain stack traces with embedded secrets when possible, adhering to the principle of least privilege for log access. Implementing strict separation between administrative interfaces and log viewing systems can further reduce the blast radius if similar vulnerabilities are discovered in other components. Regular audits of configuration files and restricted directories should also be conducted to ensure that no sensitive data is stored in locations accessible by the application runtime user without adequate protection mechanisms such as file system permissions or encryption at rest.