Detections
Analytics

Private Key File Detected

high Web App Scanning Plugin ID 115111

Synopsis

Private Key File Detected

Description

Private keys are cryptographic credentials used for secure communications in protocols like SSL/TLS, SSH, and JWT signing. If exposed, an attacker can impersonate the server, decrypt sensitive communications, or forge authentication tokens to gain unauthorized access to systems and data.

Solution

Immediately rotate and revoke the exposed private key. Remove the private key file from the publicly accessible location and store it in a secure vault or secrets management system (e.g., HashiCorp Vault, AWS Secrets Manager, Azure Key Vault). Restrict file system permissions to prevent unauthorized access. Audit logs to identify potential unauthorized use of the compromised key.

See Also

https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html

https://cheatsheetseries.owasp.org/cheatsheets/Key_Management_Cheat_Sheet.html

Plugin Details

Severity: High

ID: 115111

Type: remote

Published: 1/15/2026

Updated: 1/15/2026

Scan Template: api, basic, full, pci, scan

Risk Information

CVSS v2

Risk Factor: High

Base Score: 7.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N

CVSS Score Source: Tenable

CVSS v3

Risk Factor: High

Base Score: 7.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS Score Source: Tenable

CVSS v4

Risk Factor: High

Base Score: 8.7

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

CVSS Score Source: Tenable

Reference Information