CVE-2026-109425 tink-crypto CVE debrief

Who should care

Defenders responsible for Tink-go applications and systems, security teams, vulnerability management teams, and operators of platforms using Tink-go should assess exposure and prioritize verification and remediation. They should review keyset validation and construction, monitor for potential misuse, and update Tink-go to a version that addresses the vulnerability, if available.

Why it matters

CVE-2026-109425 is a medium-severity vulnerability in Tink-go 2.8.0 that allows malformed keysets to be accepted, potentially leading to inconsistent downstream validation. Defenders responsible for Tink-go applications should assess exposure and prioritize verification and remediation.

• Defenders must verify Tink-go versions and assess exposure to potential keyset validation bypass.
• Tink-go applications may be vulnerable to inconsistent downstream validation due to malformed keysets.
• Defenders should review keyset validation and construction to prevent potential misuse.
• Remediation priority is medium due to the potential for misleading applications that rely on successful handle construction as proof of keyset integrity.

Technical summary

Tink-go through 2.8.0 contains an input-validation vulnerability where keyset.NewHandleWithNoSecrets() and ReadWithNoSecrets() skip the structural Validate() step before constructing a keyset.Handle, allowing malformed public or no-secret keysets that violate Tink's keyset invariants to be accepted. This can cause inconsistent downstream validation where functions like jwt.JWKSetFromPublicKeysetHandle() process the invalid handle and produce a JWK set, potentially misleading applications that rely on successful handle construction as proof of keyset integrity.

Defensive priority

Defenders should prioritize verifying Tink-go versions and assessing exposure, reviewing keyset validation and construction, and monitoring for potential misuse.

Recommended defensive actions

• Verify Tink-go versions in use and assess exposure to CVE-2026-109425
• Review keyset validation and construction in Tink-go applications
• Monitor for potential misuse of Tink-go keysets
• Update Tink-go to a version that addresses the vulnerability, if available
• Perform vulnerability scanning to identify potentially affected systems
• Review system logs for signs of potential exploitation
• Implement compensating controls to mitigate potential impact

Evidence notes

The CVE record and source item provide details on the vulnerability in Tink-go 2.8.0, including affected versions and references to researcher disclosure and VulnCheck advisory. Defenders should verify Tink-go versions, assess exposure, and review keyset validation and construction. The vulnerability allows malformed keysets to be accepted, potentially leading to inconsistent downstream validation. Evidence is limited to public CVE details and researcher disclosure.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.