CVE-2026-105963: CWE-532 Insertion of Sensitive Information into Log File in elixir-plug plug

The vulnerability arises because every public function in Plug.Crypto validates argument types using function-head guards. When a guard fails, the Erlang VM raises a FunctionClauseError that includes the actual argument values in the top stack frame. This frame can contain sensitive data such as the secret key base or derived keys. The rescue blocks and Plug.Crypto.prune_args_from_stacktrace/1 only handle exceptions raised inside function bodies, not guard failures. Plug.Cowboy and Bandit write this stack frame to error logs and attach it as crash_reason Logger metadata, which error trackers forward. Two main entry points are affected: Plug.Crypto.verify/4, which exposes the secret key base when the token argument is neither binary nor nil, and Plug.Crypto.secure_compare/2, which exposes the other operand when one side is not binary (e.g., nil from a missing request header). Since reading the leaked secret requires access to logs or error trackers, the vulnerability does not allow secret disclosure from the request alone.

An unauthenticated remote attacker can cause the application to log sensitive information including secret key bases and derived keys. This exposure occurs in error logs and crash metadata, potentially allowing attackers with access to logs or error tracking systems to obtain secrets. The vulnerability does not allow direct secret disclosure via network requests alone, limiting the attack vector to those with log access.

Patch to plug version 1.7.0 or later and plug_crypto version 2.2.1 or later where this issue is fixed. Since no vendor advisory or patch links are provided, confirm patch availability with the vendor or official sources. Until patched, restrict access to logs and error tracking systems to trusted personnel only to prevent secret leakage. Monitor for updates from the elixir-plug project regarding official fixes.