Docker Desktop before version 4.97.0 could write third-party API keys and OAuth access tokens in cleartext to local application logs and diagnostics bundles due to insufficient IPC payload redaction. An attacker with read access to these files could obtain the credentials. These OAuth tokens are not Docker account tokens. Docker Desktop 4.94.0 and 4.95.0 addressed the known logging paths, but logs containing credentials can remain after upgrading. Docker Desktop 4.97.0 fixes the issue and includes cleanup of existing host logs and crash dumps.
CVE-2026-117341 is a vulnerability in Octopus Deploy's Octopus Server where creating a user invitation causes the invitation code to be written to the audit event log. If the invitation is linked to a space, users with appropriate permissions in that space can read the invitation code from the audit log. Exploiting this vulnerability by redeeming the unclaimed invitation could allow privilege escalation depending on the permissions assigned to the invited user. The issue affects versions from 2019.0.0 up to but not including 2026.2.13438, and from 2026.3.0 up to but not including 2026.3.15829. Fixed versions are 2026.2.13438 and 2026.3.15829. The CVSS 4.0 score is 7.7, indicating high severity.
CVE-2026-112250 is a vulnerability in Bizerba SE & Co. KG's BRAIN2 software up to version 3.09. Under certain installation conditions, the password for a Windows service account may be written in cleartext to a setup log file located in the temporary directory of the Windows administrator performing the installation. This occurs when Microsoft SQL Server access is configured with Integrated Security and the Windows account running the BRAIN2 MainService is specified during installation. Access to this log file is typically restricted to users with administrative privileges. The vulnerability could lead to credential disclosure of the BRAIN2 service account.
A vulnerability in langgraph CLI versions from 0.4.15 up to but not including 0.4.32 allows sensitive temporary registry push tokens to be exposed in verbose mode logs. This occurs because the CLI subprocess helper prints command input, including the token, when --verbose is used. The token can be used to pull or push images to the deployment's image repository for up to 12 hours. The issue is fixed in version 0.4.32.
A vulnerability in pghoard versions prior to 2.7.1 causes sensitive database connection information, including username and password from .pgpass files, to be logged at the debug level. This issue has been fixed in version 2.7.1.
CVE-2026-105963 is a vulnerability in elixir-plug's plug and plug_crypto components that allows sensitive information, such as the secret key base, to be exposed in application logs. This occurs due to improper handling of function argument type validation failures, which causes the Erlang VM to log argument values in error stack frames. The issue affects plug versions from 1.6.3 up to but not including 1.7.0, and plug_crypto versions from 1.0.0 up to but not including 2.2.1. Exploitation requires separate access to logs or error trackers, as the secret is not disclosed directly via the request alone.
When used as an executor in either KNIME Server or KNIME Business Hub, KNIME Analytics Platform LTS versions before 5.8.4 log configured credentials of proxies during startup. An attacker with access to log files can steal the credentials and use the proxy as the user who configured the proxy settings. The issue has been fixed in LTS versions 5.8.4 and 5.12.0 and later.
CVE-2026-96293 is a vulnerability in WatchGuard Endpoint Security's Full Disk Encryption feature for macOS. It allows a local, unprivileged user or process to access the FileVault Personal Recovery Key by reading a diagnostic log file that is stored in cleartext and readable by all local users. This vulnerability affects WatchGuard Agent versions prior to 1.17.23.0000. The issue has been fixed in version 1.17.23.0000.
CVE-2026-16648 is a vulnerability in the Drupal Mailer Plus Log module where sensitive information is inserted into log files. This issue affects versions from 0.0.0 up to but not including 1.2.7. The vulnerability could allow remote services with stolen credentials to access sensitive data. The flaw has a low severity rating and has been fixed in version 1.2.7.
Slack Morphism versions 1.0.0 through 2.27.0 improperly log the correct Slack request HMAC signature when signature verification fails. This allows an attacker who can send requests to the Slack callback endpoint and read application logs to recover the valid signature for an attacker-controlled request. The attacker can then resend the request within the allowed time window, bypassing signature verification without knowing the Slack signing secret. Version 2.28.0 fixes this issue.
CVE-2026-114471 is a vulnerability in Progressive Robot Ltd's hMailServer versions 6.0.0 through 6.3.6 involving the insertion of sensitive authentication information into SMTP server log files. When SMTP logging is enabled, certain authentication credentials such as PLAIN passwords sent before EHLO, OAuth 2.0 bearer tokens, SCRAM-SHA-256 client proofs, and GSSAPI authenticators may be logged in cleartext or recoverable form. This allows local users with read access to the log files, or anyone with a copy of them, to obtain sensitive credentials. SMTP logging is off by default, but on Windows systems prior to version 6.3.6, the log folder permissions allowed all local users to read the logs.
CVE-2026-111762 is a vulnerability in a2aproject's a2a-java SDK prior to version 1.3.0.Final. The issue involves sensitive information, including bearer tokens and authentication credentials, being logged in cleartext when a JSON request body fails protobuf deserialization. This occurs in the RestHandler.parseRequestBody method during error handling. An attacker with access to server logs could retrieve these credentials and potentially send forged push notification updates. The vulnerability is fixed in version 1.3.0.Final.
Insertion of Sensitive Information into Log File vulnerability in Apache Camel MLLP component.
This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.
The camel-mllp component carries a logPhi option that governs whether HL7 payload content may be written to the log. It defaulted to true, so a deployment that did nothing logged protected health information out of the box. Two further paths wrote payload content to the log regardless of the setting, so even an operator who had turned logPhi off was still exposed on those paths. MLLP is used to carry HL7 clinical messages, so the content concerned is patient data, and it reached ordinary application logs where it is subject to whatever retention, aggregation and access the deployment applies to logs generally rather than to clinical records.
Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. logPhi now defaults to false and is honoured on the paths that previously ignored it. This is a changed default: a deployment that relied on payload logging must now set logPhi=true explicitly. Because the upgrade guide for a change like this lives on the main branch only, operators upgrading within the 4.18.x or 4.22.x lines should treat this advisory as the notice of that change. For deployments that cannot upgrade immediately, set logPhi=false and be aware that two paths will continue to log payload content until the fix is applied; restrict access to the logs accordingly.
Apache Answer versions up to 2.0.2 contain a vulnerability where full API keys are logged on every authenticated request. This allows anyone with access to the logs to retrieve and misuse active bearer credentials. The issue is fixed in version 2.0.3.
Mattermost versions 11.7.x through 11.10.x improperly log authentication tokens in server debug logs without sanitization. This vulnerability allows anyone with access to these logs to retrieve valid session or OAuth tokens and impersonate authenticated users. The flaw is identified as CWE-532 and affects specific versions up to 11.9.1, 11.8.5, 11.7.10, and 11.10.1. The CVSS score is 4.5 (medium severity).
CVE-2026-110248 is a vulnerability in the Amazon SageMaker Python SDK where sensitive repository credentials may be logged in plaintext to CloudWatch Logs during a failed git clone operation. This occurs because the runclone_command() function in the git_utils.py component does not redact credentials from subprocess error output. The issue affects versions prior to 3.10.0 in V3 and prior to 2.257.3 in V2 of the SDK. A fix is available in these versions.
Dell Terraform Provider for OME versions 1.0.0 through 1.2.3 contain a vulnerability where sensitive information may be inserted into log files. This issue affects the provider configuration component and could be exploited by a low privileged attacker with remote access, potentially leading to information exposure. The vulnerability has a medium severity rating with a CVSS score of 4.3.
Dell Terraform Provider for Redfish versions 1.1.0 through 1.6.1 contains a vulnerability where sensitive information may be inserted into log files in the redfish_certificate resource. This could allow a high privileged remote attacker to gain access to sensitive data. The vulnerability is classified as CWE-532 and has a medium severity rating with a CVSS score of 4.3.
CVE-2026-85857 is a vulnerability in Microsoft Windows 10 Version 1607 and related builds where sensitive information is inserted into log files by Windows Kernel-Mode Drivers. This flaw allows an authorized local attacker to disclose sensitive information by accessing these logs. The issue affects multiple Windows 10 builds prior to specific fixed versions.