CVE-2026-94591

Received Received - Intake

Armatura One Hard-Coded Encryption Key in Configuration File

Publication date: 2026-10-02

Last updated on: 2026-10-02

Assigner: ICS-CERT

Description

Armatura One stores database and message-broker credentials in an install configuration file, encrypting them with AES-128-CBC when this protection is enabled. The encryption key and initialization vector are fixed values embedded in the software itself and are identical across every installation. An attacker with a copy of the installation package can recover this key and initialization vector, and can then decrypt the stored credentials of any specific installation to which the attacker separately obtains the encrypted configuration file.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-02

Last Modified

2026-10-02

Generated

2026-10-03

AI Q&A

2026-10-03

EPSS Evaluated

N/A

NVD

CVE-2026-94591

EUVD

EUVD-2026-91834

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-321	The product uses a hard-coded, unchangeable cryptographic key.

Attack-Flow Graph

Executive Summary

Armatura One stores database and message-broker credentials in an install configuration file. When encryption is enabled, it uses AES-128-CBC with fixed encryption keys and initialization vectors hardcoded in the software. This means every installation uses the same keys, allowing attackers who obtain the software package to decrypt credentials from any configuration file they access.

Detection Guidance

Check for Armatura One installation directories for configuration files containing encrypted credentials. Look for files with sensitive data stored with AES-128-CBC encryption using a fixed key and IV embedded in the software.

Impact Analysis

An attacker could decrypt stored credentials if they gain access to the encrypted configuration file. This could lead to unauthorized database access, data breaches, or compromise of sensitive information like user data or internal communications.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and encryption standards in GDPR and HIPAA. It exposes sensitive data due to weak encryption practices, potentially leading to regulatory penalties for insufficient security controls.

Mitigation Strategies

Disable the use of the vulnerable configuration file encryption method. Rotate all database and message-broker credentials stored in the configuration files. Update Armatura One to a patched version that uses a unique encryption key per installation.

Hi! I’m here to help you understand CVE-2026-94591. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70