Edit ndaal-sa-2026-417

Document Metadata

Tracking ID *

Title *

Category *

Status *

Document Version *

TLP 2.0 *

Verschlusssache

NATO

Initial Release Date *

Current Release Date *

Summary *

Publisher

Name *

Namespace *

Category *

Contact details

Affected Product

Vendor *

Product Name *

Product ID *

Product Status *

Vulnerability

Required for Security Advisories, optional for Informational / VEX.

CVE ID

Vulnerability Title

Vulnerability Description

Cipher (src/crypto.rs) wrapped a single XChaCha20-Poly1305 key. open_text/open_blob attempt one decryption and, on failure, fall back to returning the stored value unchanged -- the deliberate design that lets plaintext and sealed rows coexist without a migration. With one key that fallback is benign; the moment the key changes it becomes a silent data-loss path, because the fallback cannot distinguish 'sealed with a key I do not hold' from 'never sealed at all'. No error is raised, no log line is emitted, and the UI renders the base64 ciphertext as if it were the note's text. The security consequence is key lifecycle: because rotation was not possible, an operator who suspected the data key had leaked had no way to retire it -- the compromised key remained the only key that could read the store, indefinitely. There is no attacker in this issue and no remote trigger: it is reached by a legitimate administrative action on the host, which is why the vector is AV:L/PR:H with no user interaction and the impact is availability-only. Confidentiality and integrity are unaffected -- the ciphertext is intact and remains readable with the original key. Mapped to CWE-392 because the observable defect is the unreported failure; the underlying gap is key management (CWE-320 is the matching category, which CWE guidance does not permit as a mapping target). Threat model C-D1, which the project itself rated medium for Confidential-tier stores.

CWE ID

CWE Name

CVSS v3.1

Base Score (0.0 – 10.0)

Severity

CVSS v3.1 Vector

CVSS v4.0

Base Score (0.0 – 10.0)

Severity

CVSS v4.0 Vector

Cancel