Description
getTopologyPageInfo merged the Nimbus daemon configuration with the topology's own configuration and returned the result without redaction in the topology_conf field of TopologyPageInfo. The Storm UI copied that value verbatim into the configuration field of GET /api/v1/topology/{id} and of the corresponding metrics endpoint.
Where the cluster is configured with them, the merged map includes storm.zookeeper.auth.payload, which Storm's own documentation directs operators to keep in storm-cluster-auth.yaml under permissions that deny access from workers, together with the keystore and truststore passwords for the Thrift, Netty and ZooKeeper TLS configuration, and any plugin key whose name denotes a secret.
getTopologyPageInfo is a topology read-only operation. Under SimpleACLAuthorizer a principal listed in topology.readonly.users or topology.readonly.groups could therefore read daemon credentials that the dedicated cluster configuration API, getNimbusConf, redacts and that is gated on nimbus.users instead. The sibling operations that exist to serve configuration were masked; the topology page, which merges in strictly more daemon state, was not.
Mitigation
Upgrade to 3.1.0, where credential-bearing values are masked before any configuration is served over the Nimbus API.
Users who cannot upgrade immediately should remove any principal that is not trusted with cluster credentials from topology.readonly.users, topology.readonly.groups, topology.users and topology.groups, and should rotate the ZooKeeper authentication payload and any TLS keystore or truststore passwords that were reachable through the topology page.
Credit
Wanxin Yin (yaklang.io) reported this issue to the Apache Security Team.
Insufficiently Protected Credentials vulnerability in Apache Syncope.
Audit events, when sent to the configured store, are not sufficiently masked for the sensitive values they might carry on their payloads, thus allowing administrators to access such sensitive values.
This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.7, from 4.1.0-M0 through 4.1.2.
Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.
CWE-522: Insufficiently Protected Credentials vulnerability that could result in exposure of authentication information and unauthorized access to RTU functionality.
CVE-2026-69805 is a high-severity vulnerability in Microsoft Visual Studio 2022 version 17.14 involving external control of file name or path in .NET. This flaw allows an unauthorized attacker to elevate privileges over a network. The vulnerability affects specific versions prior to 17.14.40 and 18.9.3, and has an official fix available.
CVE-2026-64918 is a vulnerability in Microsoft 365 Apps for Enterprise version 16.0.1 where insufficiently protected credentials allow an unauthorized attacker to perform network-based spoofing. The vulnerability has a CVSS score of 6.5, indicating a medium severity. An official fix is available from Microsoft, and the vulnerability affects the specified version. No known exploits are reported in the wild.
CVE-2026-81381 is a vulnerability in Microsoft Visual Studio Code affecting versions from 1.0.0 up to but not including 1.136.2. It involves insufficiently protected credentials in GitHub Copilot and Visual Studio Code, which could allow an unauthorized attacker to disclose sensitive information over a network. The issue has been officially fixed in version 1.136.2.
CVE-2026-77909 is a high-severity vulnerability in Microsoft Azure CycleCloud 8.9.2 involving insufficiently protected credentials. This flaw allows an authorized attacker to disclose sensitive information over a network. The vulnerability has been officially fixed in version 8.9.2. No known exploits are reported in the wild.
A security issue in MongoDB Server's diagnostic reporting interface allows an authenticated user with monitoring privileges to access insufficiently protected credentials from concurrent administrative operations. The same credentials are properly redacted in server log output, but the diagnostic interface omits equivalent redaction. Successful exploitation requires a valid authenticated session with monitoring-level permissions and results in exposure of cleartext credentials that could enable impersonation of other users, including privileged accounts.
CVE-2026-76969 is a critical vulnerability in the SAP Cloud Application Programming Model (CAP) affecting the @sap/cds-mtxs NPM library. The flaw involves insufficient protection of credentials in multitenant CAP applications with extensibility enabled. An unauthenticated attacker can exploit this by sending crafted requests to obtain sensitive credentials, potentially replacing or deleting tenant data. This leads to a high impact on the availability and integrity of the application, with some confidentiality impact on business data.
A vulnerability in forgekeep nebula-mesh prior to version 0.3.8 allows cleartext storage of operator session tokens in the database. These tokens, used for operator authentication, are stored in plaintext in the operator_sessions table, enabling anyone with database read access to hijack active sessions without further authentication. The issue has been fixed in version 0.3.8.
IBM Netezza Software 11.3.0.3 through Interim Fix 002 has credentials that are hardcoded in the application source code, allowing unauthorized access to the container registry. The exposed secret enables attackers to pull private container images, potentially revealing proprietary code, configuration details, and other sensitive information.
MariaDB Connector/R2DBC versions prior to 1.4.1 do not prevent cleartext password authentication plugins from being used over unencrypted connections. This allows a malicious or man-in-the-middle MariaDB server to request cleartext password authentication over plain TCP, exposing user credentials in transit. The vulnerability is fixed in version 1.4.1.
MariaDB Connector/J versions prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9 have a vulnerability where PAM dialog authentication can transmit the account password in cleartext over insecure connections. This occurs because the PAM handler 'dialog' does not require secure transport, unlike the mysql_clear_password plugin. A malicious or man-in-the-middle server can exploit this by sending an Authentication Switch Request over plain TCP, causing the driver to expose the password if sslMode=DISABLE and restrictedAuth=null (default settings). The issue is fixed in the specified versions.
MariaDB Connector/J versions prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9 contain a vulnerability where the initial handshake path does not properly enforce certificate fingerprint verification. This allows a man-in-the-middle or hostile server to present a self-signed certificate and receive the full database password via the mysql_clear_password authentication plugin before the connection is rejected.
MariaDB Connector/Node.js versions prior to 3.2.4, 3.3.3, 3.4.6, and 3.5.3 can expose account passwords in cleartext during PAM dialog authentication over insecure transport. This occurs because the connector does not enforce secure transport for the PAM password authentication dialog, allowing a hostile or on-path server to trigger password disclosure over plain TCP. The issue is mitigated by using properly verified TLS or local Unix sockets. The vulnerability has a CVSS score of 5.9 (medium severity) and is fixed in the specified versions.
MariaDB Connector/Node.js versions prior to 3.3.3, 3.4.6, and 3.5.3 have an improper certificate validation vulnerability. When SSL is enabled without a pinned CA or server certificate, the connector may send credentials before completing certificate fingerprint validation. This allows a man-in-the-middle attacker to present a self-signed certificate, capture the database password, and authenticate directly even though the connection is later closed. The issue is fixed in versions 3.3.3, 3.4.6, and 3.5.3.
CVE-2026-73839 is a vulnerability in the Ebyte NE2-D11 Firmware where administrative credentials are exposed in plaintext within the device's management interface. This exposure risks credential compromise through visual or remote observation, undermining the confidentiality of device access. The vulnerability has a medium severity rating with a CVSS score of 4.6.
CVE-2026-64632 is a high-severity vulnerability in Veeam ONE that allows a low-privileged user to capture the NTLM credentials of the Reporter service account. This issue relates to insufficient protection of credentials (CWE-522). No patch or official remediation guidance has been provided yet.
Rently Smart Home versions 20.1.0 and earlier have an Insufficiently Protected Credentials vulnerability (CWE-522) that allows attackers to retrieve sensitive PINs, including the Master PIN, bypassing normal user permissions. This vulnerability has a high severity score of 8.7. No official patch or remediation guidance is currently available from the vendor.
NVIDIA NemoClaw has a vulnerability identified as CVE-2026-65087 involving insufficiently protected credentials. This flaw could allow an attacker with limited privileges and user interaction to cause information disclosure and data tampering. The vulnerability has a medium severity rating with a CVSS score of 5.6. No affected versions or patch information are provided in the available data.