CVE-2026-24785: Clatter Information Disclosure Vulnerability

CVE-2026-24785 Overview

CVE-2026-24785 is a cryptographic vulnerability in Clatter, a no_std compatible, pure Rust implementation of the Noise protocol framework with post-quantum support. Versions prior to 2.2.0 contain a protocol compliance flaw where the library allowed post-quantum handshake patterns that violated the PSK validity rule defined in Section 9.3 of the Noise Protocol Framework specification. This vulnerability could allow PSK-derived keys to be used for encryption without proper randomization by self-chosen ephemeral randomness, significantly weakening security guarantees and potentially enabling catastrophic key reuse scenarios.

Critical Impact

Improper PSK handling in post-quantum handshake patterns could lead to weakened cryptographic security and potential key reuse, undermining the confidentiality guarantees of encrypted communications.

Affected Products

• Clatter versions prior to 2.2.0
• Affected default patterns: noise_pqkk_psk0, noise_pqkn_psk0, noise_pqnk_psk0, noise_pqnn_psk0
• Some hybrid pattern variants using *_psk0 configurations

Discovery Timeline

• 2026-01-28 - CVE-2026-24785 published to NVD
• 2026-01-29 - Last updated in NVD database

Technical Details for CVE-2026-24785

Vulnerability Analysis

This vulnerability stems from improper implementation of the Noise Protocol Framework's validity rules for Pre-Shared Key (PSK) handshake patterns. The Noise Protocol Framework specification explicitly defines validity constraints in Section 9.3 to ensure cryptographic operations maintain their intended security properties. In the affected versions of Clatter, post-quantum handshake patterns with PSK at position 0 (designated as *_psk0 patterns) were permitted despite violating these validity rules.

When a PSK is positioned at psk0 in these post-quantum patterns, the key derivation occurs before any ephemeral randomness is mixed into the handshake state. This creates a dangerous scenario where the derived encryption keys lack proper randomization, making them deterministic based solely on the PSK. An attacker exploiting this weakness could potentially predict or manipulate the derived keys, leading to catastrophic key reuse across multiple sessions.

Root Cause

The root cause is a broken cryptography issue (CWE-327) where the library's pattern validation logic failed to enforce the PSK validity rules specified by the Noise Protocol Framework. Specifically, the implementation allowed psk0 positions in post-quantum handshake patterns where the first message token is not an ephemeral key exchange (e or ee). Without ephemeral randomness preceding the PSK mixing, the cryptographic guarantees of the protocol are fundamentally compromised.

Attack Vector

The vulnerability is exploitable over a network by any party that can initiate or participate in a Noise protocol handshake using the affected patterns. An attacker does not require authentication or user interaction to exploit this vulnerability. The attack could proceed as follows:

1. Attacker identifies a target application using Clatter with an affected *_psk0 post-quantum pattern
2. Attacker engages in multiple handshakes with the target
3. Due to the lack of proper ephemeral randomization, derived keys become predictable
4. Attacker leverages key predictability to decrypt captured communications or impersonate parties

The following patch shows the removal of the vulnerable *_psk0 patterns from the library:

         noise_pqin_psk1(),
         noise_pqin_psk2(),
         noise_pqix_psk2(),
-        noise_pqkk_psk0(),
         noise_pqkk_psk2(),
-        noise_pqkn_psk0(),
         noise_pqkn_psk2(),
         noise_pqkx_psk2(),
-        noise_pqnk_psk0(),
         noise_pqnk_psk2(),
-        noise_pqnn_psk0(),
         noise_pqnn_psk2(),
         noise_pqnx_psk2(),
         noise_pqxk_psk3(),

Source: GitHub Commit Changes

The fix also introduces proper error handling for invalid patterns:

     Cipher(#[from] CipherError),
     /// Transport error: {0}
     Transport(#[from] TransportError),
+    /// Handshake pattern error: {0}
+    Pattern(#[from] PatternError),
 }
 
 /// Handshake operation result type

Source: GitHub Commit Changes

Detection Methods for CVE-2026-24785

Indicators of Compromise

• Applications configured to use noise_pqkk_psk0, noise_pqkn_psk0, noise_pqnk_psk0, or noise_pqnn_psk0 handshake patterns
• Clatter library versions below 2.2.0 in project dependencies (Cargo.toml or Cargo.lock)
• Runtime logs indicating use of post-quantum patterns with psk0 suffix
• Cryptographic audit findings showing deterministic key derivation in Noise protocol sessions

Detection Strategies

• Audit Cargo.toml and Cargo.lock files for Clatter dependency versions below 2.2.0
• Search codebase for string literals matching vulnerable pattern names: pqkk_psk0, pqkn_psk0, pqnk_psk0, pqnn_psk0
• Implement dependency scanning tools to flag vulnerable Clatter versions in CI/CD pipelines
• Review custom handshake pattern definitions for PSK validity rule compliance

Monitoring Recommendations

• Enable SentinelOne Singularity Platform for continuous monitoring of application dependencies and runtime behavior
• Configure alerts for applications using known vulnerable cryptographic patterns
• Monitor for unusual patterns in encrypted session establishment that may indicate key reuse
• Implement software composition analysis (SCA) to track vulnerable library versions across the organization

How to Mitigate CVE-2026-24785

Immediate Actions Required

• Upgrade Clatter to version 2.2.0 or later immediately
• Audit all applications using Clatter for affected handshake patterns
• If using custom patterns, review them against the Noise Protocol Validity Rules
• Consider rotating any PSKs used with affected patterns as a precautionary measure

Patch Information

The vulnerability has been fully patched in Clatter version 2.2.0. The fix includes runtime checks to detect and reject offending handshake patterns that violate PSK validity rules. Users should update their Cargo.toml dependency to specify the patched version. For technical details on the patch, refer to the GitHub Security Advisory GHSA-253q-9q78-63x4 and the commit implementing the fix.

Workarounds

• Avoid using *_psk0 variants of post-quantum patterns (noise_pqkk_psk0, noise_pqkn_psk0, noise_pqnk_psk0, noise_pqnn_psk0)
• Use *_psk2 or *_psk3 variants instead, which ensure ephemeral randomness precedes PSK mixing
• For custom handshake patterns, ensure PSK tokens only appear after an ephemeral key exchange token
• Review the Noise Protocol Framework specification Section 9.3 for proper pattern construction

# Update Clatter dependency in Cargo.toml
# Replace the vulnerable version with the patched version
sed -i 's/clatter = ".*"/clatter = "2.2.0"/' Cargo.toml

# Verify the update
cargo update -p clatter
cargo build