A vulnerability that records guest OS processing credentials in cleartext in a support log on the guest, allowing a user with read access to that… (CVE-2026-58070)

CVE-2026-58070 is a vulnerability where guest OS processing credentials are logged in cleartext in a support log on the guest system. This allows any user with read access to the log to retrieve privileged account credentials. The vulnerability is categorized as CWE-532 (Exposure of Information Through Log Files). There is no information about available patches or fixes. The vulnerability has a CVSS version 4.0 vector indicating local attack vector, low attack complexity, no user interaction, and high impact on confidentiality. No known exploits are reported in the wild.

The vulnerability exposes privileged account credentials in cleartext logs accessible to users with read permissions on the guest system. This can lead to unauthorized access or privilege escalation if an attacker can read the support log. The impact is primarily on confidentiality of sensitive credentials.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict read access to support logs on guest systems to trusted users only to reduce the risk of credential exposure.