This vulnerability (CVE-2026-33583) in Arqit's Symmetric Key Agreement Platform exposes sensitive cryptographic keys (QKEY and internal system keys) via an unauthenticated and unencrypted HTTP GET request. The QKEY is used as input in the OTA-Quantum device registration process. The exposure occurs in versions before 26.03, allowing remote attackers to obtain keys without any authentication or encryption protection. The CVSS 3.1 score is 8.7, indicating high severity with network attack vector, high complexity, no privileges required, no user interaction, and impacts on confidentiality and integrity but not availability. No patch or official remediation level has been published yet.

The vulnerability allows remote attackers to obtain critical cryptographic keys without authentication or encryption, which can lead to compromise of device registration processes and potentially undermine the security guarantees of the platform. Confidentiality and integrity impacts are rated high, meaning sensitive keys could be disclosed or manipulated, but availability is not affected. This could facilitate further attacks on systems relying on these keys.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to the affected HTTP endpoints and monitor for unauthorized access attempts. Avoid using affected versions in sensitive environments where key confidentiality is critical.