CVE-2026-33584

MediumCVSS 5.3

Published: 13/05/2026(UTC)Updated: 26/10/2026(UTC)Translated: 26/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.31%

23th percentile - higher than 23% of all known CVEs

Summary

An exposed Keycloak management service in the Arqit Symmetric Key Agreement Platform enables unauthorized access to sensitive debug information such as metrics and health data. This issue affects versions before 26.03.

Risk Assessment

An unauthorized attacker may gain access to internal diagnostic data, potentially facilitating further attacks against the platform.

Recommendation

Update the platform to version 26.03 or later and restrict network access to the Keycloak management service.

Other vulnerabilities in Arqit Symmetric Key Agreement Platform

CVE-2026-33583High
CVE-2026-33583 vulnerability involves the exposure of the QKEY and internal system keys via an unauthenticated and unencrypted HTTP GET method in the Arqit Symmetric Key Agreement Platform. This issue affects versions of the platform before 26.03.

Original NVD description (English source)

Exposed Keycloak management service in the Arqit Symmetric Key Agreement Platform enables unauthorized access to sensitive debug information such as metrics and health data. This issue affects Symmetric Key Agreement Platform: before 26.03.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS