Security readout for executives and security teams
Plain-English summary
Older Keybase mobile clients could leave supposedly self-deleting chat messages on a recipient's Android or iOS device in a specific backgrounding scenario. The issue affects confidentiality only and is rated low severity, but it matters where staff relied on exploded messages to remove sensitive content.
Executive priority
Treat as a low-priority hygiene fix unless Keybase mobile was used for sensitive or regulated conversations. Prioritize updates through normal endpoint management rather than emergency response.
Technical view
Keybase Client for Android and iOS before 5.8.0 may fail to remove exploded messages when the recipient backgrounds the chat session while the sender explodes messages. CVSS 3.1 is 3.7: network reachable, high attack complexity, low confidentiality impact, no integrity or availability impact.
Likely exposure
Exposure is limited to organizations using Keybase mobile clients below 5.8.0, especially for sensitive chat workflows using exploded messages. Desktop clients are not identified in the provided sources.
Exploitation context
The provided sources do not report active exploitation, and the CVE is not in KEV. The condition appears timing-dependent and requires the recipient's chat session to be backgrounded during message explosion.
Researcher notes
No CWE is listed in the provided CVE data. Evidence is limited to the CVE record and Zoom reference. The issue is a retained-data confidentiality flaw, not code execution or privilege escalation.
Mitigation direction
- Update Keybase Android and iOS clients to version 5.8.0 or later.
- Review Zoom's security bulletin for any vendor-specific guidance.
- Do not rely on exploded messages for regulated secrets on unverified clients.
- Use MDM or app inventory to remove outdated Keybase mobile versions.
Validation and detection
- Confirm Android Keybase client versions are 5.8.0 or later.
- Confirm iOS Keybase client versions are 5.8.0 or later.
- Identify teams using Keybase exploded messages for sensitive communications.
- Review mobile app inventory for unmanaged or stale Keybase installs.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-34421 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Low
- CVSS
- 3.7 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N2.21.4Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
3.7LowVector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://explore.zoom.us/en/trust/security/security-bulletinCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.