Tillitis TKey Client package is a Go package for a TKey client. Versions 1.2.0 and below contain a critical bug in the tkeyclient Go module which causes 1 out of every 256 User Supplied Secrets (USS) to be silently ignored, producing the same Compound Device Identifier (CDI)—and thus the same key material—as if no USS is provided. This happens because a buffer index error overwrites the USS-enabled boolean with the first byte of the USS digest, so any USS whose hash starts with 0x00 is effectively discarded. This issue has been fixed in version 1.3.0. Users unable to upgrade immediately should switch to a USS whose hash does not begin with a zero byte.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Tillitis TKey Client package is a Go package for a TKey client. Versions 1.2.0 and below contain a
    critical bug in the tkeyclient Go module which causes 1 out of every 256 User Supplied Secrets (USS) to be
    silently ignored, producing the same Compound Device Identifier (CDI)—and thus the same key material—as if
    no USS is provided. This happens because a buffer index error overwrites the USS-enabled boolean with the
    first byte of the USS digest, so any USS whose hash starts with 0x00 is effectively discarded. This issue
    has been fixed in version 1.3.0. Users unable to upgrade immediately should switch to a USS whose hash
    does not begin with a zero byte. (CVE-2026-32953)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Tillitis TKey Client package is a Go package for a TKey client. Versions 1.2.0 and below contain a     critical bug in the tkeyclient Go module which causes 1 out of every 256 User Supplied Secrets (USS) to be     silently ignored, producing the same Compound Device Identifier (CDI)and thus the same key materialas if     no USS is provided. This happens because a buffer index error overwrites the USS-enabled boolean with the     first byte of the USS digest, so any USS whose hash starts with 0x00 is effectively discarded. This issue     has been fixed in version 1.3.0. Users unable to upgrade immediately should switch to a USS whose hash     does not begin with a zero byte. (CVE-2026-32953)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
438903	SCA: security update for github.com/tillitis/tkeyclient (GHSA-4w7r-3222-8h6v)	Tenable Cloud Security	SCA Checks	medium
438903	SCA: security update for github.com/tillitis/tkeyclient (GHSA-4w7r-3222-8h6v)	Tenable Self-Hosted Container Security	SCA Checks	medium
302820	Linux Distros Unpatched Vulnerability : CVE-2026-32953	Nessus	Misc.	medium

Detections

Analytics

CVE-2026-32953

medium

Tenable Plugins

medium

medium

medium