Skip to content
OpenAdvisories

Weakness (CWE)

CWE-322: Key Exchange without Entity Authentication

Base Draft

The product performs a key exchange with an actor without verifying the identity of that actor.

How to prevent it (2 mitigations)

  1. Architecture and Design

    Ensure that proper authentication is included in the system design.

  2. Implementation

    Understand and properly implement all checks necessary to ensure the identity of entities involved in encrypted communications.

Source: MITRE CWE-322

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 9.1
    CVE-2026-94134 Public exploit

    Apache Airflow SSH provider, Apache Airflow SFTP provider: SSH hook disables host-key verification by default

    The Apache Airflow SSH provider hook disables SSH host-key verification by default: unless `host_key` is configured or `no_host_key_check` is explicitly set to false, it accepts any server key. This affects SSH and SFTP connections that rely on the default. A…

    Apache Software Foundation Apache Airflow SFTP provider Apache Airflow SSH provider
  • High 7.5
    CVE-2026-33697 Public exploit

    CoCoS attested TLS is vulnerable to relay attacks via extracted ephemeral TLS keys

    Cocos AI is a confidential computing system for AI. The current implementation of attested TLS (aTLS) in CoCoS is vulnerable to a relay attack affecting all versions from v0.4.0 through v0.8.2. This vulnerability is present in both the AMD SEV-SNP and Intel T…

    ultravioletrs cocos