Keybase Desktop Client before 5.6.0 on Windows and macOS, and before 5.6.1 on Linux, allows an attacker to obtain potentially sensitive med…

published 2021-02-22 5 y ago modified 2026-06-17 4 mo ago also EUVD-2021-10755

cvss: 5.5; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 0.3%; EPSS 0.3% chance of exploitation in 30 days, percentile 22%
public exploits: 0; none known

Keybase Desktop Client before 5.6.0 on Windows and macOS, and before 5.6.1 on Linux, allows an attacker to obtain potentially sensitive media (such as private pictures) in the Cache and uploadtemps directories. It fails to effectively clear cached pictures, even after deletion via normal methodology within the client, or by utilizing the "Explode message/Explode now" functionality. Local filesystem access is needed by the attacker.

Patch / fix

fixed in 1

keybase keybase 5.6.0, 5.6.1

Exploit prediction

0.30% chance of exploitation in the next 30 days, higher than 22% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

johnjhacking.com https://johnjhacking.com/blog/cve-2021-23827/ referenced PoC, tagged "exploit" by a source, unverified
hackerone.com https://hackerone.com/reports/1074930 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
NVD	3.1	5.5	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
NVD	2.0	2.1	AV:L/AC:L/Au:N/C:P/I:N/A:N

Classification

Weakness

CWE-312 Cleartext Storage of Sensitive Information

References

johnjhacking.com /blog/cve-2021-23827/
exploit, third-party-advisory
hackerone.com /reports/1074930
exploit, issue-tracking, third-party-advisory
github.com /keybase/client/releases
release-notes, third-party-advisory

Sources

CVE List CVE-2021-23827
NVD CVE-2021-23827

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary