CVE-2026-108089: CWE-497 Exposure of sensitive system information to an unauthorized control sphere in Apache Software Foundation Apache Cocoon
Description
** UNSUPPORTED WHEN ASSIGNED ** Exposure of sensitive system information to an unauthorized control sphere vulnerability in Apache Cocoon. An unauthenticated user could gain access to diagnostic interfaces, including triggering of cache, exposure of (verbose) debug logging and profile information. This issue affects Apache Cocoon: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CVSS v3.1
Score 7.5high
Affected software
Apache Software Foundation
Apache Cocoon
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-108089 is an exposure of sensitive system information vulnerability (CWE-497) in Apache Cocoon. It allows unauthenticated attackers to access diagnostic interfaces that reveal verbose debug logging and profile information, as well as trigger cache operations. This vulnerability affects all versions of Apache Cocoon. Since the project is retired, no official patches or fixes will be provided.
Potential Impact
An unauthenticated attacker can gain access to sensitive diagnostic information and control interfaces, potentially revealing system internals and debug data. This exposure could aid attackers in further reconnaissance or exploitation efforts. However, no direct code execution or data modification is described.
Mitigation Recommendations
No official fix is available because Apache Cocoon is retired. Users should restrict access to the affected instances to trusted users only or migrate to alternative supported software.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- apache
- Date Reserved
- 2026-10-09T12:28:02.604Z
- State
- PUBLISHED
Threat ID: 6ad743942cdf04f6561fc71b
Added to database: 10/20/2026, 10:33:56 UTC
Last enriched: 10/20/2026, 10:48:27 UTC
Last updated: 10/20/2026, 22:33:05 UTC
Views: 9
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.