CWE-532: Sensitive Data in Logs vulnerabilities

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability where sensitive information is inserted into log files. This flaw could allow a local attacker with limited privileges to access sensitive credentials from these logs and potentially compromise accounts.

IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a vulnerability where sensitive information may be inserted into log files. This could allow a remote authenticated attacker to access sensitive data through log file exposure. The vulnerability has a CVSS score of 6.8, indicating a medium severity level.

CVE-2026-106019 is a vulnerability in Johnson Controls C-CURE 9000, Victor version 3.20 that involves the insertion of sensitive information into log files. This flaw allows the use of known operating system credentials, potentially exposing sensitive data through logs. The vulnerability has a high severity rating with a CVSS 4.0 score of 8.8.

In JetBrains Junie CLI before 26.6.29 sensitive environment variables were exposed in session event logs

OpenHuman versions prior to 0.57.5 use the JSON-RPC bearer token as an approval session identifier, which is exposed in persisted approval records, events, debug logs, and RPC responses. This exposure allows an attacker who obtains these artifacts to recover the token and access the core RPC interface with the privileges of the token. The vulnerability can lead to exposure of sensitive agent and integration data and permit privileged operations. The issue is fixed in version 0.57.5.

CVE-2026-73100 is a critical vulnerability in Apache Juneau up to version 9.2.0 where sensitive information such as Authorization headers and API keys are logged in cleartext when a server error occurs. This exposure occurs because the default REST server call logger does not redact sensitive request headers before writing them to application logs. The issue is fixed in version 9.2.1.

CVE-2026-14252 is a vulnerability in IBM MQ versions 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD. It involves the insertion of potentially sensitive information into log files, which could be accessed by a local user. The vulnerability has a CVSS 3.1 base score of 6.2, indicating a medium severity level.

CVE-2026-91163 is a vulnerability in warpgate, an open source SSH, HTTPS, and MySQL bastion host for Linux. Prior to version 0.29.0, the Kubernetes protocol listener improperly handles authentication failures by returning detailed internal error messages, including ASN.1/DER parser diagnostics and database errors, in HTTP 500 responses. These error messages are exposed to unauthenticated network clients and are not logged by the gateway, potentially leaking sensitive internal diagnostic information. The issue is fixed in version 0.29.0.

This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to the recording of authentication tokens in application logs used for development and debugging. A local attacker with an access to logs could exploit this vulnerability by retrieving and misusing the exposed session tokens. Successful exploitation of this vulnerability could allow the attacker to impersonate the associated user and gain unauthorized access to vehicle related information and services.

A component of the MongoDB Rust Driver that records diagnostic tracing data can capture command content before automatic client-side field level encryption is applied. In deployments that turn on the optional tracing capability together with automatic in-use encryption, a party with read access to the application's exported trace data may obtain field values that the application designated for encryption, without access to the encryption keys. This may result in unintended disclosure of data.

A vulnerability in the armurox loggingredactor Python library prior to version 0.0.7 allows sensitive information to be logged without redaction when non-primitive objects with custom __str__ or __repr__ methods are logged. This causes personally identifiable information to appear in logs that are expected to mask such data. The issue is fixed in version 0.0.7.

Insertion of Sensitive Information into Log File (CWE-532) in the ARP Agent component in AxxonSoft AxxonNet before 3.25.0 on Windows and Linux allows a local attacker with read access to ARP Agent log files or support packages to obtain the plaintext password of the LDAP directory service account via WARNING-level log entries that contain serialized user synchronization data.

When an Event Publisher output adapter is configured with properties that are irrelevant to its function, the affected products log these irrelevant properties. This can inadvertently include sensitive user credentials or other confidential information depending on the nature of the misconfigured property. A malicious actor with access to the 'wso2carbon' log files could retrieve sensitive information logged by the system. This may potentially lead to unauthorized access if the logged data contains credentials or other critical secrets.

In Modem, there is a possible information disclosure due to side channel information disclosure. This could lead to local information disclosure if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: MOLY01744265; Issue ID: MSV-9505.

Element Call is a native Matrix video conferencing application. From 0.16.0 until 0.20.3, the standalone Element Call `SPA` logs the `password` URL query parameter. When a user submits an error report, called a rageshake, these logs are shared with the application operator. Users can therefore unintentionally disclose the shared `password` used to encrypt the call, potentially compromising call confidentiality. Avoiding submission of bug reports or debug logs prevents this disclosure path in affected versions. Upgrading does not remove secrets from previously collected `rageshakes`, which require separate cleanup by the log-server operator. This issue is fixed in version 0.20.3.

Insertion of sensitive information into a log file in Amazon Kinesis Producer Library for Java before 1.0.8, when the library's logger is configured at DEBUG log level, might allow local users to obtain the AWS credentials that the library resolved for the application. Separately, affected versions of the library pass these credentials to the native child process as command-line arguments, where a local user can read them from the process argument list. To remediate this issue, users should upgrade to version 1.0.8 or later, rotate any long-term IAM user keys, revoke active role sessions where needed, and restrict or redact log data written by an affected version. 0.x users should migrate to software.amazon.kinesis:amazon-kinesis-producer 1.0.8 or later.

A vulnerability in zuke-build's zuke prior to version 1.51.0 allows sensitive information derived from secrets to be inserted into GitHub Actions summary files without redaction. This can expose credentials in cleartext to anyone who can view the workflow run, including unauthenticated users on public repositories. The issue is fixed in version 1.51.0.

Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows may log user passwords in clear text, exposing them to other administrators. This vulnerability allows an administrator with access to logs to obtain another user's password and potentially escalate privileges on the server.

CVE-2026-79656 is a vulnerability in Grafana OSS where sensitive OAuth and OIDC tokens are logged unredacted under certain conditions. This occurs when access or ID tokens are invalid JWTs, missing (at debug level), or not strings, exposing tokens in server logs. The exposure is limited to the scopes granted to the OAuth client. The issue affects multiple versions of Grafana OSS and has been fixed in versions 12.4.11, 13.0.9, 13.1.6, and 13.2.2.

MLflow versions from 2.19.0 up to but not including 3.17.0 contain a vulnerability where the mlflow.crewai.autolog() function records CrewAI Agent objects without properly sanitizing nested credential data. This results in plaintext provider API keys being included in trace data sent to the MLflow trace backend or OTLP destinations, exposing sensitive credentials to unauthorized readers. The issue is resolved in version 3.17.0.