Weakness (CWE)
CWE-532: Insertion of Sensitive Information into Log File
The product writes sensitive information to a log file.
How to prevent it (4 mitigations)
-
Architecture and Design, Implementation
Consider seriously the sensitivity of the information written into log files. Do not write secrets into the log files.
-
Distribution
Remove debug log files before deploying the application into production.
-
Operation
Protect log files against unauthorized read/write.
-
Implementation
Adjust configurations appropriately when software is transitioned from a debug state to production.
Source: MITRE CWE-532
1,021 results · Feed
-
Medium 6.5
OpenPanel before 3.0.0 Sensitive Information Exposure via Application Logs
OpenPanel before 3.0.0 contains an information exposure vulnerability that writes database connection URLs and email template data to standard output logs. Users with log access can obtain database credentials from migration startup logs and password-reset to…
-
Low 3.3
A logging issue was addressed with improved data redaction. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27…
-
Low 3.3
A logging issue was addressed with improved data redaction. This issue is fixed in macOS Golden Gate 27, macOS Sequoia …
-
Medium 6.2
A logging issue was addressed with improved data redaction. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Gold…
-
Medium 4.4
Cleartext Storage of Windows Service Account Password in BRAIN2 Setup Log Files
A vulnerability has been identified in BRAIN2 versions up to and including version 3.09. Under specific installation conditions, the password of a Windows service account may be written in cleartext to a setup log file. The issue occurs when Microsoft SQL Ser…
-
Medium 4.1
LangGraph CLI prints the registry push token in `langgraph deploy --verbose` output
The LangGraph CLI is the official command-line interface for LangGraph. From 0.4.15 until 0.4.32, langgraph deploy --verbose passes a temporary registry push token on standard input to docker login --password-stdin, but the CLI subprocess helper prints comman…
-
Low 2.4
PGHoard: Password written to debug log
pghoard is a PostgreSQL backup daemon and restore tooling that stores backup data in cloud object stores. Prior to version 2.7.1, when using .pgpass, database connection information including the username and password will be logged at the debug level. This i…
-
Medium 5.1
Secret key base exposed in stack trace arguments on wrong-typed Plug.Crypto arguments
Externally-Generated Error Message Containing Sensitive Information vulnerability in plug_crypto in elixir-plug plug_crypto allows an unauthenticated remote attacker to expose the secret key base through application logs via a wrong-typed argument. Every publ…
-
Medium 4.8
KNIME Analytics Platform logs credentials of configured proxy when used as an executor
When used as an executor in either KNIME Server or KNIME Business Hub, KNIME Analytics Platform LTS versions before 5.8.4 log configured credentials of proxies during startup. An attacker with access to log files can steal the credentials and use the proxy as…
-
Low 2.0
OpenBao before 2.6.3 Sensitive Data Leak in Audit Log via Malformed Parameters
OpenBao before 2.6.3 contains an information disclosure vulnerability that allows attackers to leak sensitive data into audit logs by sending malformed plugin parameters. Attackers can submit requests with malformed TypeKVPair or TypeHeader field values, caus…
-
Medium 6.9
Endpoint Security Cleartext Storage of FileVault Recovery Key in Log File
A cleartext storage of sensitive information vulnerability in WatchGuard Endpoint Security's Full Disk Encryption feature for macOS allows a local, unprivileged user or process to obtain a managed computer's FileVault Personal Recovery Key by reading a persis…
-
Low 3.8
Mailer Plus Log - Moderately critical - Access bypass - SA-CONTRIB-2026-128
Insertion of Sensitive Information into Log File vulnerability in Drupal Mailer Plus Log allows Remote Services with Stolen Credentials. This issue affects Mailer Plus Log versions: from 0.0.0 to 1.2.7.
-
Medium 5.3
Slack Morphism verifier errors disclose valid HMACs in the logs
Slack Morphism is a client library for Slack Web/Events API/Socket Mode and Block Kit. Versions 1.0.0 through 2.27.0 expose the correct Slack request HMAC when signature verification fails. For an invalid request, `slack-morphism` computes the correct signatu…
-
Medium 4.7
Insertion of Sensitive Information into Log File in hMailServer
Insertion of sensitive information into a log file in the SMTP server of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a local user who can read the server's log, or anyone given a copy of it, to obtain credentials. With SMTP logging enabled, the s…
-
Medium 5.5
Trigger.dev CLI before 4.5.9 Secret Exposure via Debug Deployment Logs
Trigger.dev CLI before 4.5.9 contains an information disclosure vulnerability that exposes resolved environment secret values in debug deployment logs by serializing unredacted envVars. Attackers with access to terminal transcripts, CI debug logs, or support …
-
Medium 5.7
A2A Java SDK: Push notification credentials logged in cleartext on protobuf parse failure
A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. Prior to 1.3.0.Final, RestHandler.parseRequestBody in `transport/rest/src/main/java/org/a2aproject/sdk/transport/rest/handler/RestHandler.java` logs the entire JSON request body at SEVE…
-
Medium 5.5CVE-2026-85260 Public exploit
Apache Camel: Camel-MLLP Protected Health Information Disclosure to Logs by Default
Insertion of Sensitive Information into Log File vulnerability in Apache Camel MLLP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The camel-mllp component carries a logPhi option that governs whether HL7 payl…
-
High 8.1
Apache Answer: API keys logged in plaintext during authentication
Insertion of Sensitive Information into Log File vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. Full API keys are written to application logs on every authenticated request, allowing anyone with log-read access to recover and…
-
Medium 4.5
Mattermost logs plaintext authentication tokens in debug-level server logs on failed auth attempts
Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to sanitize authentication tokens before writing them to server log entries, which allows an attacker with access to server logs to obtain valid session tokens …
-
Medium 5.3
Insertion of sensitive information into log files in Amazon SageMaker Python SDK git_utils[.]py
Insertion of sensitive information into log files in the git_utils[.]py component in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 before 2.257.3 might allow an authenticated remote user to obtain plaintext repository credentials from CloudWatch Logs wh…
-
Medium 4.3
Dell Terraform Provider for OME, versions 1.0.0 through 1.2.3, contains an Insertion of Sensitive Information into Log …
-
Medium 4.3
Dell Terraform Provider for Redfish, versions 1.1.0 through 1.6.1, contains an Exposure of Sensitive Information to an …
-
Medium 5.5
Clevis: clevis: pkcs#11 luks passphrase logged in plaintext to world-readable file
A flaw was found in the clevis PKCS#11 pin. The clevis-pkcs11-afunix-socket-unlock daemon logs LUKS disk encryption passphrases in plaintext to a log file. The log file is created without restrictive permissions, making it world-readable under the default pro…
-
Medium 5.3
Improper Request Handling for Active Directory Logins in auth0-lock
When a username for an Active Directory connection is a domain without a local part, the auth0-lock library initiates the authentication transaction with a GET request instead of a POST request. As a result, user-submitted form data is appended to the URL as …
-
Medium 5.5
Windows Kernel-Mode Drivers Information Disclosure Vulnerability
Insertion of sensitive information into log file in Windows Kernel-Mode Drivers allows an authorized attacker to disclose information locally.
-
Medium 5.5
An Information Exposure Through Log Files vulnerability in Ivanti Xtraction Cloud Sync before version 2026.4 allows a r…
-
Medium 6.2
Insertion of Sensitive Information into Log File in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.0 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with access to GitLab Pages log data to obtain a…
-
Medium 4.9
Frappe 14.x before 14.45.0 Information Disclosure via Error Log Tracebacks
Frappe 14.x before 14.45.0 contains an information disclosure vulnerability that allows users with error log access to view secrets stored in local variables captured in tracebacks. Attackers who can read error logs can extract plaintext secrets such as crede…
-
High 7.5
Sensitive information exposure in Progress MarkLogic Server Azure deployments
On Azure deployments, Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 may record security-sensitive authentication information in diagnostic logs under certain configurations. An attacker with access to the affected logs …
-
High 8.1
Sensitive information exposure in Progress MarkLogic Server trace logs
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 may record security-sensitive information in diagnostic logs under certain configurations. An attacker with access to the affected logs could use this information to obtain …
-
Medium 5.5
Predibase LoRAX through 0.12.1 API Token Exposure via Router Logs
Predibase LoRAX through 0.12.1 contains a sensitive information exposure vulnerability that writes the caller-supplied api_token from POST /generate request bodies into router logs. Attackers with access to router logs or OTLP trace backends can recover other…
-
Low 3.3
Hugging Face Text Embeddings Inference through 1.9.4 Cleartext API Key Logging
Hugging Face Text Embeddings Inference through 1.9.4 contains a cleartext logging vulnerability that exposes the configured api_key because the router's Args struct lacks a redact attribute for it. Attackers with access to router logs, container output, or OT…
-
Low 3.3
GPT-Load through 1.4.11 Cleartext Proxy Key Logging via Access Logger
GPT-Load through 1.4.11 contains a cleartext logging vulnerability that exposes client proxy keys because the Gin Logger middleware records the raw query string before extractAuthKey strips the key parameter. Attackers with read access to console logs or ./da…
-
Medium 5.9
Insertion of sensitive information into log file in AWS Tools for PowerShell
Insertion of sensitive information into log file in AWS Tools for PowerShell before 5.0.306 might allow local users to recover an IAM user's cleartext AWS Management Console password from command output and log artifacts. To remediate this issue, users should…
-
Low 3.1
Security vulnerability affects the UNIX S-TAP component as part of IBM Guardium Data Protection
IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a local attacker to obtain sensitive information due to cleartext storage of sensitive information in logs.
-
Low 2.3
Pydantic AI OpenTelemetry instrumentation: retry prompt content is not redacted when `include_content=False`
Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 0.3.4 until 1.107.4 and 2.27.1, OpenTelemetry instrumentation configured with InstrumentationSettings(include_content=False) can export retry prompts outs…
-
Low 2.3
Pydantic AI OpenTelemetry instrumentation: exception events on tool and agent run spans include content when `include_content=False`
Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 0.3.4 until 1.107.6 and 2.44.0, OpenTelemetry instrumentation configured with InstrumentationSettings(include_content=False) can still export sensitive ag…
-
Medium 6.8
An information disclosure vulnerability exists in the SupportLink diagnostic collection utilities of Brocade Fabric OS …
-
High 7.5
Apache Geode: Management REST API: Insertion of Sensitive Information into Log File
Insertion of Sensitive Information into Log File in Apache Geode Web Management. This issue affects Apache Geode: from 2.0.0 before 2.0.3. Users are recommended to upgrade to version 2.0.3, which fixes the issue.
-
High 8.4
Insertion of Sensitive Information into Log File in certain ASUS router models allows a remote authenticated attacker t…