CVE-2026-21439
📋 TL;DR
This vulnerability allows attackers to inject ASCII control characters and ANSI escape sequences into badkeys tool output, creating misleading results when scanning DKIM and SSH keys. This affects users of badkeys versions 0.0.15 and below who rely on automated scanning results. The misleading output could cause administrators to incorrectly assess the security of cryptographic keys.
💻 Affected Systems
- badkeys
📦 What is this software?
Badkeys by Badkeys
⚠️ Risk & Real-World Impact
Worst Case
Administrators accept vulnerable cryptographic keys as secure due to manipulated output, leading to compromised DKIM email authentication or SSH access.
Likely Case
Confusion in automated scanning pipelines causing manual review delays or incorrect key assessments.
If Mitigated
Minor output formatting issues that are caught during manual review of scanning results.
🎯 Exploit Status
Proof of concept exists in GitHub issues. Exploitation requires ability to control input to badkeys (e.g., DNS records, SSH key files).
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.0.16
Vendor Advisory: https://github.com/badkeys/badkeys/security/advisories/GHSA-wjpc-4f29-83h3
Restart Required: No
Instructions:
1. Update badkeys using pip: 'pip install --upgrade badkeys==0.0.16' 2. Verify installation with 'badkeys --version' 3. Test scanning functionality with known test keys.
🔧 Temporary Workarounds
Input sanitization wrapper
linuxCreate a wrapper script that sanitizes input before passing to badkeys
#!/bin/bash
# Remove control characters from input
sanitized_input=$(echo "$1" | tr -d '\000-\037\177')
badkeys "$sanitized_input"
🧯 If You Can't Patch
- Manually review all badkeys output for suspicious characters or formatting anomalies
- Use alternative key validation tools in parallel to verify badkeys results
🔍 How to Verify
Check if Vulnerable:
Run 'badkeys --version' and check if version is 0.0.15 or belowCheck Version:
badkeys --versionVerify Fix Applied:
Test with known malicious input containing control characters and verify output is properly sanitized📡 Detection & Monitoring
Log Indicators:
- Unusual output formatting in badkeys logs
- Presence of control characters (\x0B, \x1B) in scanning results
Network Indicators:
- DNS queries for DKIM records followed by unexpected badkeys output
SIEM Query:
process.name:"badkeys" AND (message:"\x0B" OR message:"\x1B" OR message:"ESC")🔗 References
- https://github.com/badkeys/badkeys/commit/635a2f3b1b50a895d8b09ec8629efc06189f349a
- https://github.com/badkeys/badkeys/commit/de631f69f040974bb5fb442cdab9a1d904c64087
- https://github.com/badkeys/badkeys/issues/40
- https://github.com/badkeys/badkeys/security/advisories/GHSA-wjpc-4f29-83h3
- https://github.com/badkeys/badkeys/issues/40
