Security readout for executives and security teams
Plain-English summary
CVE-2026-21439 affects the badkeys command-line tool. Malformed input can inject terminal control characters, making scan output misleading. This is primarily an operator-trust and reporting integrity issue, not a system compromise issue. The vendor states it is fixed in version 0.0.16.
Executive priority
Handle through normal patch management. The business risk is misleading security-tool output, which can affect decisions, but available evidence supports low severity and no known active exploitation.
Technical view
badkeys versions 0.0.15 and below insufficiently neutralize ASCII control characters in console output. Affected paths include DKIM scanning, SSH key line mode, and filenames in multiple modes. The issue is classified as CWE-150 with CVSS 4.0 score 2.0 and low integrity impact.
Likely exposure
Exposure is limited to organizations using badkeys versions below 0.0.16, especially where it processes untrusted DKIM records, SSH key lists, or filenames and humans rely on terminal output.
Exploitation context
Sources describe misleading console output through malformed input. No provided source or KEV status indicates active exploitation. The impact is output manipulation, not disclosed remote code execution, credential theft, or service disruption.
Researcher notes
Review the GitHub advisory, issue 40, and the two linked commits for exact sanitization changes. Evidence is sufficient for affected versions and fixed version, but public sources provided do not describe broader product impact or exploitation in the wild.
Mitigation direction
- Upgrade badkeys to version 0.0.16 or later.
- Prioritize systems that process untrusted DKIM, SSH key, or filename input.
- Treat historical terminal output from affected versions as potentially misleading.
- Review vendor advisory and commits for implementation-specific guidance.
Validation and detection
- Inventory installed badkeys versions across developer, CI, and security tooling environments.
- Confirm no deployed instance is running version 0.0.15 or below.
- Identify workflows using --dkim, --dkim-dns, --ssh-lines, or filename-based scanning.
- Re-run important scans after upgrading if prior results drove decisions.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-150: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-21439 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Low
- CVSS
- 2 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P——Primary CVE scoreVulnerability scoring details
Base CVSS 4.0 score
2LowVector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/badkeys/badkeys/security/advisories/GHSA-wjpc-4f29-83h3CVE reference · x_refsource_CONFIRM
- https://github.com/badkeys/badkeys/issues/40CVE reference · x_refsource_MISC
- https://github.com/badkeys/badkeys/commit/635a2f3b1b50a895d8b09ec8629efc06189f349aCVE reference · x_refsource_MISC
- https://github.com/badkeys/badkeys/commit/de631f69f040974bb5fb442cdab9a1d904c64087CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Escape, Meta, or Control Sequences
Improper Neutralization of Escape, Meta, or Control Sequences represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.