High · CVSS 8.2CVE-2026-95105

Cloak AES-CTR cipher lacks ciphertext authentication, allowing chosen-plaintext forgery by bit flippingCVE-2026-95105

Answer in brief

CVE-2026-95105 records a High severity (CVSS 8.2) vulnerability in Cloak AES-CTR cipher lacks ciphertext authentication, allowing chosen-plaintext forgery by bit flipping. The current sources do not mark it as known exploited. The current feed maps danielberkompas/cloak (generic), danielberkompas/danielberkompas/cloak (generic). Check affected ranges and fixed versions before updating.

Analysis pending evidence review

HOL Guard separates source facts from reviewed analysis. See the methodology.

Published Oct 6, 2026Updated Oct 6, 2026Source checked Oct 6, 2026First seen by HOL Oct 6, 2026Material review Oct 6, 2026

Upstream Advisory

Key facts

Risk: High · CVSS 8.2
Exploitation: Not marked as known exploited
Affected software: 2 mapped packages or products
Fix availability: Available

Why this deserves its current priority

CVSS is 8.2. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps danielberkompas/cloak (generic), danielberkompas/danielberkompas/cloak (generic). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
danielberkompas/cloakgeneric	>=0.1.0-pre <*	*
danielberkompas/danielberkompas/cloakgeneric	>=2bd17019e285b55c5c218cc842537bf9280f24c3 <*	*

Recommended response

Check inventory. Check lockfiles and deployed manifests for danielberkompas/cloak, danielberkompas/danielberkompas/cloak.
Review the reported fix. Source-reported workaround: Configure the vault with Cloak.Ciphers.AES.GCM as the default cipher and re-encrypt existing values, for example with the cloak.migrate.ecto task from cloak_ecto. Then remove Cloak.Ciphers.AES.CTR and Cloak.Ciphers.Deprecated.AES.CTR from the vault configuration, so that ciphertext in the CTR format is no longer decrypted. AES-GCM authenticates the ciphertext and rejects modified values.

Evidence timeline and material changes

Published upstream
Oct 6, 2026
Evidence: source:cvelist:source_dates:source-dates:record
Source modified
Oct 6, 2026
Evidence: source:cvelist:source_dates:source-dates:record
First seen by HOL
Oct 6, 2026

Sources and claim methodology

Upstream source description

Reliance on Obfuscation or Encryption of Security-Relevant Inputs without Integrity Checking vulnerability in danielberkompas cloak allows an attacker with write access to stored ciphertext to make it decrypt to a chosen value via bit flipping. Cloak.Ciphers.AES.CTR encrypts with AES-256 in CTR mode and stores the key tag, the IV and the ciphertext with no MAC. decrypt/2 checks only the key tag and the minimum length before it returns the plaintext, and Cloak.Ciphers.Deprecated.AES.CTR decrypts the legacy format the same way. CTR is a stream cipher, so a value XORed into the stored ciphertext is XORed into the plaintext at the same offset. An attacker who can write to the encrypted store (for example through SQL injection or a compromised replica) and who knows or can guess a stored plaintext can replace it with any value of the same length. The application receives that value with no error. This issue affects cloak: from 0.1.0-pre onward.

Quoted source text, attributed separately from HOL analysis.