A reported flaw in GoBalance, a Go implementation used by some hidden services for availability, can allow recovery of the private key controlling an affected .onion address from public information. Reporting attributes the issue to the signing path, where only part of a Tor-format private key was passed to the signer.
The consequence is address takeover, not necessarily server compromise. A recovered key could be used to publish descriptors that direct visitors to an impersonating service. The reporting says original Onionbalance and Tor itself are not affected.
Operator response
- Identify vulnerable GoBalance configurations, particularly those using Tor-format master keys.
- Generate a new address and migrate users through signed, independently verifiable announcements.
- Do not rely on an update alone: a key exposed through a published descriptor cannot become secret again.
- Advise users to treat affected old addresses as unsafe and reset credentials where appropriate.
No official fix or CVE was reported at publication time, making key rotation and address migration central to response.
Source: The Hacker News, citing Searchlight Cyber (October 9, 2026).