CVE-2026-26315
📋 TL;DR
A cryptographic flaw in go-ethereum's ECIES implementation allows attackers to extract bits of the p2p node key. This affects all Geth nodes running versions before 1.16.9. The vulnerability could compromise node identity and network communication security.
💻 Affected Systems
- go-ethereum (Geth)
📦 What is this software?
Go Ethereum by Ethereum
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of node identity allowing impersonation, man-in-the-middle attacks on p2p communications, and potential network isolation or reputation damage.
Likely Case
Partial key extraction enabling targeted attacks against specific nodes, potentially leading to network manipulation or denial of service.
If Mitigated
Minimal impact if node key is rotated immediately after patching, though historical communications may have been vulnerable.
🎯 Exploit Status
Exploitation requires network access to vulnerable nodes and cryptographic analysis capabilities.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.16.9 or 1.17.0
Vendor Advisory: https://github.com/ethereum/go-ethereum/security/advisories/GHSA-m6j8-rg6r-7mv8
Restart Required: Yes
Instructions:
1. Stop Geth service. 2. Upgrade to Geth v1.16.9 or v1.17.0. 3. Delete the node key file: rm <datadir>/geth/nodekey. 4. Start Geth service to generate new key.
🔧 Temporary Workarounds
Node Key Rotation
allManually rotate node key without upgrading (temporary measure)
geth --datadir <datadir> removedb
rm <datadir>/geth/nodekey
🧯 If You Can't Patch
- Isolate vulnerable nodes from untrusted networks
- Implement network-level monitoring for unusual p2p traffic patterns
🔍 How to Verify
Check if Vulnerable:
Check Geth version with: geth versionCheck Version:
geth versionVerify Fix Applied:
Verify version is 1.16.9+ and confirm new node key was generated by checking file timestamp: ls -la <datadir>/geth/nodekey📡 Detection & Monitoring
Log Indicators:
- Unexpected p2p connection failures
- Node key regeneration events
Network Indicators:
- Unusual ECIES handshake patterns
- Multiple failed connection attempts to same node
SIEM Query:
source="geth" AND ("nodekey" OR "ECIES" OR "handshake failed")