Arqit Symmetric Key Agreement Platform exposes its Keycloak management service, allowing unauthenticated users to retrieve sensitive debug information such as metrics and health data, thereby violating confidentiality. The weakness is classified as CWE-749, reflecting the vulnerability of revealing protected data through improper access controls.

Vendors affected are Arqit, specifically the Symmetric Key Agreement Platform. Any installation using a version prior to 26.03 is vulnerable and must be updated to mitigate this issue.

The vulnerability has a CVSS score of 5.3, indicating moderate severity. EPSS data is unavailable and the vulnerability is not listed in CISA KEV. The likely attack vector is remote; an attacker who can reach the exposed Keycloak endpoint can retrieve discarded debug data without authentication. Exploitation does not require local privileges but depends on network reachability to the service.