Keybase is a focused end-to-end encryption and identity-verification platform whose vulnerability profile, despite a narrow product footprint, has skewed toward serious outcomes and frequently acquired public exploit availability. The vendor's recurring exposure centers on sensitive-data handling weaknesses such as cleartext storage, path traversal, improper data removal, cryptographic-signature verification failures, and incomplete cleanup—issues that directly undermine the security assurances users rely on from encryption and authentication tools. Defenders deploying Keybase for secure communication should monitor releases closely; live severity and exploitation figures are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Keybase over time
Signals from CVEs in this vendor scope (8 CVEs).
8 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2018-18629HIGH An issue was discovered in the Keybase command-line client before 2.8.0-20181023124437 for Linux. An untrusted search path vulnerability in the keybase-redirector application allow | Dec 20, 2018 | 7.8 | 34 | NO | YES |
CVE-2021-34422CRITICAL The Keybase Client for Windows before version 5.7.0 contains a path traversal vulnerability when checking the name of a file uploaded to a team folder. A malicious user could uploa | Nov 11, 2021 | 9.0 | 28 | NO | NO |
CVE-2019-7249CRITICAL In Keybase before 2.12.6 on macOS, the move RPC to the Helper was susceptible to time-to-check-time-to-use bugs and would also allow one user of the system (who didn't have root ac | Jan 31, 2019 | 9.8 | 25 | NO | NO |
CVE-2021-34426HIGH A vulnerability was discovered in the Keybase Client for Windows before version 5.6.0 when a user executed the "keybase git lfs-config" command on the command-line. In versions pri | Dec 14, 2021 | 7.8 | 24 | NO | NO |
CVE-2019-16992HIGH The Keybase app 2.13.2 for iOS provides potentially insufficient notice that it is employing a user's private key to sign a certain cryptocurrency attestation (that an address at k | Sep 30, 2019 | 7.5 | 23 | NO | NO |
CVE-2021-23827MEDIUM Keybase Desktop Client before 5.6.0 on Windows and macOS, and before 5.6.1 on Linux, allows an attacker to obtain potentially sensitive media (such as private pictures) in the Cach | Feb 23, 2021 | 5.5 | 20 | NO | NO |
The Keybase Clients for macOS and Windows before version 5.9.0 fails to properly remove exploded messages initiated by a user. This can occur if the receiving user switches to a no | Feb 9, 2022 | 3.7 | 17 | NO | NO |
CVE-2021-34421MEDIUM The Keybase Client for Android before version 5.8.0 and the Keybase Client for iOS before version 5.8.0 fails to properly remove exploded messages initiated by a user if the receiv | Nov 11, 2021 | 4.3 | 17 | NO | NO |
Signals from CVEs in this vendor scope (8 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Keybase.
Media articles that mention a CVE ID that affects a product developed by Keybase — matched by CVE ID, not by vendor name.