CVE-2026-33117: Security feature bypass vulnerability in Azure Key Vault Keys library for Java
The Java Key Vault Keys library in the Azure SDK for Java contains an issue in the local cryptographic verification path where authentication tag comparison was implemented incorrectly. In affected applications that use the vulnerable local cryptography path, specially crafted encrypted input may bypass integrity verification checks. Operations delegated to the Key Vault service are not affected.
Published May 12, 2026 · Updated Jun 2, 2026
Affected packages
com.azure:azure-security-keyvault-keys
- Ecosystem
- Maven
- Affected
- < 4.10.6
- Fixed in
- 4.10.6
- Check
mvn dependency:tree -Dincludes=com.azure:azure-security-keyvault-keys
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
The Java Key Vault Keys library in the Azure SDK for Java contains an issue in the local cryptographic verification path where authentication tag comparison was implemented incorrectly. In affected applications that use the vulnerable local cryptography path, specially crafted encrypted input may bypass integrity verification checks. Operations delegated to the Key Vault service are not affected. The issue is addressed in version 4.10.6.
Credited to scottaddie.
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-33117
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33117
- https://github.com/Azure/azure-sdk-for-java/pull/48476
- https://github.com/Azure/azure-sdk-for-java/commit/1b5c5c79d85a5c9a9cfd07f6cdff6fd0f50eccf9
- https://github.com/advisories/GHSA-97jf-46m3-8953
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology