PT-2026-1358 · Badkeys · Badkeys

Hannob · Published 2026-01-05 · Updated 2026-01-06 · CVE-2026-21439

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions badkeys versions 0.0.15 and below

Description badkeys is a tool and library used for checking cryptographic public keys for known issues. In versions 0.0.15 and below, an attacker can inject content containing ASCII control characters, such as vertical tabs and ANSI escape sequences. This injection can lead to misleading output when using the badkeys command-line tool. This affects scanning DKIM keys (using both --dkim and --dkim-dns options), SSH keys (in --ssh-lines mode), and filenames in various modes.

Recommendations Update to version 0.0.16 or later.

Exploit

Fix

Weakness Enumeration

CWE-150

Related Identifiers

CVE-2026-21439

GHSA-WJPC-4F29-83H3

Affected Products

Badkeys

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/21xxx/CVE-2026-21439.json · Exploit
• 🔥 https://github.com/badkeys/badkeys/issues/40 · Exploit
• https://github.com/badkeys/badkeys/commit/de631f69f040974bb5fb442cdab9a1d904c64087 · Patch
• https://github.com/badkeys/badkeys/commit/635a2f3b1b50a895d8b09ec8629efc06189f349a · Patch
• https://osv.dev/vulnerability/CVE-2026-21439 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-wjpc-4f29-83h3 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-21439 · Security Note
• https://github.com/badkeys/badkeys · Note
• https://github.com/badkeys/badkeys/security/advisories/GHSA-wjpc-4f29-83h3 · Note
• https://twitter.com/VulmonFeeds/status/2008366560964923855 · Twitter Post
• https://twitter.com/CVEnew/status/2008346538708521084 · Twitter Post
• https://t.me/CVEtracker/41451 · Telegram Post