CVE-2026-15811
Received Received - Intake

Memory Disclosure in Kronosnet Cryptographic Configuration

Publication date: 2026-07-21

Last updated on: 2026-07-21

Assigner: Red Hat, Inc.

Description
A vulnerability was found in kronosnet's (version <=1.34) cryptographic configuration management. The framework does not correctly zero-out or wipe sensitive memory segments after executing changes to its cryptographic configuration. This omission leaves raw encryption keys resident in memory after the associated structures are freed. A local attacker capable of leveraging memory disclosure techniques could exploit this flaw to retrieve the active encryption key, allowing them to decrypt cluster network communications or inject malicious packets to cause severe high-availability cluster instability.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-21
Last Modified
2026-07-21
Generated
2026-07-21
AI Q&A
2026-07-21
EPSS Evaluated
N/A
NVD
CVE-2026-15811
EUVD
EUVD-2026-46153

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
kronosnet kronosnet to 1.34 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-212 The product stores, transfers, or shares a resource that contains sensitive information, but it does not properly remove that information before the product makes the resource available to unauthorized actors.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-15811 is a flaw in kronosnet versions up to 1.34 where sensitive memory segments containing encryption keys are not properly wiped after cryptographic configuration changes. This leaves raw keys resident in memory even after structures are freed, allowing potential retrieval by local attackers.

Detection Guidance

Detecting this vulnerability requires checking for exposed memory segments containing encryption keys after cryptographic configuration changes. Use tools like 'strings' or 'grep' to scan memory dumps for key material. Monitor kronosnet logs for failed memory sanitization events. Check for unauthorized packet injection or decryption attempts in cluster network traffic.

Impact Analysis

A local attacker could exploit this to retrieve active encryption keys, decrypt cluster network communications, or inject malicious packets. This may lead to severe high-availability cluster instability or unauthorized access to sensitive data transmitted within the cluster.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data transmitted within a cluster, potentially violating confidentiality requirements in GDPR and HIPAA. Exposure of encryption keys may result in data breaches, triggering compliance violations for data protection and security controls.

Mitigation Strategies

Upgrade kronosnet to version 1.35 or later to address the memory sanitization flaw. Restart affected services to clear residual key material from memory. Implement additional monitoring for memory disclosure or unauthorized network activity. Restrict local access to systems running kronosnet to reduce attack surface.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-15811. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart