CWE-532
AllowedInsertion of Sensitive Information into Log File
Abstraction: Base · Status: Incomplete
The product writes sensitive information to a log file.
1961 vulnerabilities reference this CWE, most recent first.
GHSA-3GH4-CGHQ-F8V4
Vulnerability from github – Published: 2026-10-08 17:16 – Updated: 2026-10-08 17:16Summary
Pydantic AI's OpenTelemetry instrumentation supports InstrumentationSettings(include_content=False) to exclude message content — user prompts, model completions, tool call arguments and responses — from exported telemetry, so that agents can be monitored without sending sensitive content to the observability backend.
Retry prompts — the feedback messages Pydantic AI sends back to the model when its output fails validation or an output validator raises ModelRetry — were not covered by this setting when they were not associated with a tool call, as with structured output modes that don't use tool calls (e.g. NativeOutput or PromptedOutput) and output validators applied to text output. Their full content was recorded on model request spans even with include_content=False. Since validation feedback can quote invalid values from the model's response, message content that the setting was configured to withhold could reach the telemetry backend.
Details
Retry prompts without an associated tool call were serialized into span message attributes (such as gen_ai.input.messages and pydantic_ai.all_messages) as regular text parts, and this path did not apply the include_content check that every other message part applies. Retry prompts tied to a tool call, and all other message content, were redacted correctly.
Impact
This does not grant an attacker any new access to the agent or its data: the content is only visible to whoever can read the exported telemetry. The exposure matters when traces are exported to a destination whose audience is broader or less trusted than the agent's own data — a third-party observability vendor or a shared backend — which is the scenario include_content=False exists for. The disclosed content is limited to retry feedback: validation error details, which can quote invalid values from the model's output, or output-validator ModelRetry messages.
Who Is Affected
You are affected if you enabled instrumentation with include_content=False and your agent can produce retry prompts outside of tool calls: it uses a structured output mode that doesn't rely on tool calls (such as NativeOutput or PromptedOutput), or output validators on text output. You are not affected if you don't set include_content=False, or if all of your agent's retries come from tool calls (including the default tool-based structured output mode), which were redacted correctly.
Remediation
Upgrade to a patched version; retry prompt content now honors include_content=False like all other message content. If you rely on this setting, consider reviewing previously exported traces for retry prompt content that should not have been recorded.
Workaround for Unpatched Versions
If you cannot upgrade, scrub or drop the message attributes (gen_ai.input.messages, gen_ai.output.messages, pydantic_ai.all_messages) in your telemetry pipeline (for example with an OpenTelemetry Collector processor), or use tool-based structured output modes, whose retry feedback honors include_content=False.
Credits
Reported privately by the University of Sydney Security Research Team (Liyi Zhou, Ziyue Wang, Strick, Maurice, Chenchen Yu), and later independently discovered and reported publicly, with a fix, by @sean-kim05.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "pydantic-ai"
},
"ranges": [
{
"events": [
{
"introduced": "0.3.4"
},
{
"fixed": "1.107.4"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "pydantic-ai"
},
"ranges": [
{
"events": [
{
"introduced": "2.0.0b1"
},
{
"fixed": "2.27.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "pydantic-ai-slim"
},
"ranges": [
{
"events": [
{
"introduced": "0.3.4"
},
{
"fixed": "1.107.4"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "pydantic-ai-slim"
},
"ranges": [
{
"events": [
{
"introduced": "2.0.0b1"
},
{
"fixed": "2.27.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-107293"
],
"database_specific": {
"cwe_ids": [
"CWE-212",
"CWE-532"
],
"github_reviewed": true,
"github_reviewed_at": "2026-10-08T17:16:32Z",
"nvd_published_at": null,
"severity": "LOW"
},
"details": "### Summary\n\nPydantic AI\u0027s OpenTelemetry instrumentation supports `InstrumentationSettings(include_content=False)` to exclude message content \u2014 user prompts, model completions, tool call arguments and responses \u2014 from exported telemetry, so that agents can be monitored without sending sensitive content to the observability backend.\n\nRetry prompts \u2014 the feedback messages Pydantic AI sends back to the model when its output fails validation or an output validator raises `ModelRetry` \u2014 were not covered by this setting when they were not associated with a tool call, as with structured output modes that don\u0027t use tool calls (e.g. `NativeOutput` or `PromptedOutput`) and output validators applied to text output. Their full content was recorded on model request spans even with `include_content=False`. Since validation feedback can quote invalid values from the model\u0027s response, message content that the setting was configured to withhold could reach the telemetry backend.\n\n### Details\n\nRetry prompts without an associated tool call were serialized into span message attributes (such as `gen_ai.input.messages` and `pydantic_ai.all_messages`) as regular text parts, and this path did not apply the `include_content` check that every other message part applies. Retry prompts tied to a tool call, and all other message content, were redacted correctly.\n\n### Impact\n\nThis does not grant an attacker any new access to the agent or its data: the content is only visible to whoever can read the exported telemetry. The exposure matters when traces are exported to a destination whose audience is broader or less trusted than the agent\u0027s own data \u2014 a third-party observability vendor or a shared backend \u2014 which is the scenario `include_content=False` exists for. The disclosed content is limited to retry feedback: validation error details, which can quote invalid values from the model\u0027s output, or output-validator `ModelRetry` messages.\n\n### Who Is Affected\n\nYou are affected if you enabled instrumentation with `include_content=False` and your agent can produce retry prompts outside of tool calls: it uses a structured output mode that doesn\u0027t rely on tool calls (such as `NativeOutput` or `PromptedOutput`), or output validators on text output. You are not affected if you don\u0027t set `include_content=False`, or if all of your agent\u0027s retries come from tool calls (including the default tool-based structured output mode), which were redacted correctly.\n\n### Remediation\n\nUpgrade to a patched version; retry prompt content now honors `include_content=False` like all other message content. If you rely on this setting, consider reviewing previously exported traces for retry prompt content that should not have been recorded.\n\n### Workaround for Unpatched Versions\n\nIf you cannot upgrade, scrub or drop the message attributes (`gen_ai.input.messages`, `gen_ai.output.messages`, `pydantic_ai.all_messages`) in your telemetry pipeline (for example with an OpenTelemetry Collector processor), or use tool-based structured output modes, whose retry feedback honors `include_content=False`.\n\n### Credits\n\nReported privately by the University of Sydney Security Research Team (Liyi Zhou, Ziyue Wang, Strick, Maurice, Chenchen Yu), and later independently discovered and reported publicly, with a fix, by @sean-kim05.",
"id": "GHSA-3gh4-cghq-f8v4",
"modified": "2026-10-08T17:16:32Z",
"published": "2026-10-08T17:16:32Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-3gh4-cghq-f8v4"
},
{
"type": "WEB",
"url": "https://github.com/pydantic/pydantic-ai/pull/7357"
},
{
"type": "WEB",
"url": "https://github.com/pydantic/pydantic-ai/commit/fe9dbed7b7ccf7e7128b5786886e4441f6f5594f"
},
{
"type": "PACKAGE",
"url": "https://github.com/pydantic/pydantic-ai"
},
{
"type": "WEB",
"url": "https://github.com/pydantic/pydantic-ai/releases/tag/v2.27.1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Pydantic AI OpenTelemetry instrumentation: retry prompt content is not redacted when `include_content=False`"
}
GHSA-3GRH-XHCF-MGX4
Vulnerability from github – Published: 2022-05-24 17:34 – Updated: 2022-05-24 17:34An information-disclosure flaw was found in the way that gluster-block before 0.5.1 logs the output from gluster-block CLI operations. This includes recording passwords to the cmd_history.log file which is world-readable. This flaw allows local users to obtain sensitive information by reading the log file. The highest threat from this vulnerability is to data confidentiality.
{
"affected": [],
"aliases": [
"CVE-2020-10762"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-11-24T17:15:00Z",
"severity": "MODERATE"
},
"details": "An information-disclosure flaw was found in the way that gluster-block before 0.5.1 logs the output from gluster-block CLI operations. This includes recording passwords to the cmd_history.log file which is world-readable. This flaw allows local users to obtain sensitive information by reading the log file. The highest threat from this vulnerability is to data confidentiality.",
"id": "GHSA-3grh-xhcf-mgx4",
"modified": "2022-05-24T17:34:51Z",
"published": "2022-05-24T17:34:51Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-10762"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1845067"
},
{
"type": "WEB",
"url": "https://github.com/gluster/gluster-block/releases/tag/v0.5.1"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-3GRX-945C-Q563
Vulnerability from github – Published: 2022-05-14 01:48 – Updated: 2022-05-14 01:48An Information Exposure Through Log Files issue was discovered in Citrix SD-WAN 10.1.0 and NetScaler SD-WAN 9.3.x before 9.3.6 and 10.0.x before 10.0.4.
{
"affected": [],
"aliases": [
"CVE-2018-17447"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-10-23T21:30:00Z",
"severity": "HIGH"
},
"details": "An Information Exposure Through Log Files issue was discovered in Citrix SD-WAN 10.1.0 and NetScaler SD-WAN 9.3.x before 9.3.6 and 10.0.x before 10.0.4.",
"id": "GHSA-3grx-945c-q563",
"modified": "2022-05-14T01:48:30Z",
"published": "2022-05-14T01:48:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-17447"
},
{
"type": "WEB",
"url": "https://support.citrix.com/article/CTX236992"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/105711"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-3H2W-68PX-R4V5
Vulnerability from github – Published: 2025-10-31 09:30 – Updated: 2025-10-31 15:30Sensitive data exposure via logging in basic-auth leads to plaintext usernames and passwords written to error logs and forwarded to log sinks when log level is INFO/DEBUG. This creates a high risk of credential compromise through log access. It has been fixed in the following commit: https://github.com/apache/apisix/pull/12629 Users are recommended to upgrade to version 3.14, which fixes this issue.
{
"affected": [],
"aliases": [
"CVE-2025-62232"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-10-31T09:15:48Z",
"severity": "HIGH"
},
"details": "Sensitive data exposure via logging in basic-auth leads to plaintext usernames and passwords written to error logs and forwarded to log sinks when log level is INFO/DEBUG. This creates a high risk of credential compromise through log access.\nIt has been fixed in the following commit:\u00a0 https://github.com/apache/apisix/pull/12629 \nUsers are recommended to upgrade to version 3.14, which fixes this issue.",
"id": "GHSA-3h2w-68px-r4v5",
"modified": "2025-10-31T15:30:31Z",
"published": "2025-10-31T09:30:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62232"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/32hdgh570btfhg02hfc7p7ckf9v83259"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2025/10/30/4"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-3H9G-5X56-226C
Vulnerability from github – Published: 2022-05-06 00:00 – Updated: 2022-05-14 00:03On F5 BIG-IP 15.1.x versions prior to 15.1.5.1 and 14.1.x versions prior to 14.1.4.6, when installing Net HSM, the scripts (nethsm-safenet-install.sh and nethsm-thales-install.sh) expose the Net HSM partition password. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
{
"affected": [],
"aliases": [
"CVE-2022-28859"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-05-05T17:15:00Z",
"severity": "MODERATE"
},
"details": "On F5 BIG-IP 15.1.x versions prior to 15.1.5.1 and 14.1.x versions prior to 14.1.4.6, when installing Net HSM, the scripts (nethsm-safenet-install.sh and nethsm-thales-install.sh) expose the Net HSM partition password. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated",
"id": "GHSA-3h9g-5x56-226c",
"modified": "2022-05-14T00:03:30Z",
"published": "2022-05-06T00:00:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-28859"
},
{
"type": "WEB",
"url": "https://support.f5.com/csp/article/K47662005"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-3HMQ-7955-4976
Vulnerability from github – Published: 2022-05-13 01:36 – Updated: 2022-05-13 01:36IBM WebSphere MQ 7.5, 8.0, and 9.0 through 9.0.4 could allow a local user to obtain highly sensitive information via trace logs in IBM WebSphere MQ Managed File Transfer. IBM X-Force ID: 137042.
{
"affected": [],
"aliases": [
"CVE-2017-1795"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-07-06T14:29:00Z",
"severity": "MODERATE"
},
"details": "IBM WebSphere MQ 7.5, 8.0, and 9.0 through 9.0.4 could allow a local user to obtain highly sensitive information via trace logs in IBM WebSphere MQ Managed File Transfer. IBM X-Force ID: 137042.",
"id": "GHSA-3hmq-7955-4976",
"modified": "2022-05-13T01:36:58Z",
"published": "2022-05-13T01:36:58Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-1795"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/137042"
},
{
"type": "WEB",
"url": "http://www.ibm.com/support/docview.wss?uid=swg22012389"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-3HWH-VWHH-599C
Vulnerability from github – Published: 2026-09-14 21:31 – Updated: 2026-09-17 18:31A logging issue was addressed with improved data redaction. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to access user-sensitive data.
{
"affected": [],
"aliases": [
"CVE-2026-84525"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-14T21:17:29Z",
"severity": "MODERATE"
},
"details": "A logging issue was addressed with improved data redaction. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to access user-sensitive data.",
"id": "GHSA-3hwh-vwhh-599c",
"modified": "2026-09-17T18:31:33Z",
"published": "2026-09-14T21:31:52Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84525"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/149035"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/149042"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/149043"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-3J8C-R7F9-V4VM
Vulnerability from github – Published: 2026-10-03 00:31 – Updated: 2026-10-03 00:31Armatura One's backup and restore routine records the full database connection command, including the superuser password, in plain text in a log file on the host. Credentials disclosed by this finding can be used to access the database when access to the server operating system is available.
{
"affected": [],
"aliases": [
"CVE-2026-94593"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-02T22:16:56Z",
"severity": "HIGH"
},
"details": "Armatura One\u0027s backup and restore routine records the full database connection command, including the superuser password, in plain text in a log file on the host. Credentials disclosed by this finding can be used to access the database when access to the server operating system is available.",
"id": "GHSA-3j8c-r7f9-v4vm",
"modified": "2026-10-03T00:31:13Z",
"published": "2026-10-03T00:31:13Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-94593"
},
{
"type": "WEB",
"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-274-01.json"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-274-01"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-3JH5-RR2Q-XFV7
Vulnerability from github – Published: 2026-05-11 16:11 – Updated: 2026-05-14 20:54Summary
The LoggingRestClientCustomizer in the web module automatically intercepts all outgoing HTTP calls made via Spring's RestClient and logs the full request body, response body, and response headers. When an error response is received, this information is included in the thrown HttpClientErrorException message, which is logged at ERROR level by Spring's default exception handling — regardless of the application's DEBUG log level setting.
Impact
The logged data can contain highly sensitive information including:
- Authentication credentials (JWT tokens, API keys, OAuth tokens) in request bodies or response headers
- Personal data (BSN, email addresses, case details) in request/response bodies
- Session tokens in Set-Cookie response headers
This data is exposed to: - Anyone with access to application logs (stdout/log files) - Users with access to logging aggregation tools (e.g. Grafana/Loki) - Any Valtimo user with the admin role, through the built-in logging module (since Valtimo 12.5.0)
Leaked authentication credentials could be used to impersonate the Valtimo application against the target external API (e.g. ZGW services), compromising that API's security boundary.
Related: GHSA-hfrg-mcvw-8mch (similar sensitive data exposure in InboxHandlingService)
Affected Code
com.ritense.valtimo.web.logging.LoggingRestClientCustomizer#intercept in the web module.
Patched Versions
The vulnerability is fixed in: - 12.33.0 (v12 release line) — see PR #600 - 13.26.0 (v13 release line) — see PR #599
The fix removes the request/response report, headers, and response body from the HttpClientErrorException constructor; only the HTTP status code and status text remain. The full request/response report is still emitted at DEBUG level (disabled in production).
Mitigation
If you cannot upgrade to a patched version immediately, consider:
- Restricting access to application logs and the Valtimo logging module
- Adjusting the log level for com.ritense.valtimo.web.logging to WARN or higher (note: this only mitigates the DEBUG logging path; error responses still leak data via the exception message)
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "com.ritense.valtimo:web"
},
"ranges": [
{
"events": [
{
"introduced": "12.4.0"
},
{
"fixed": "12.33.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "com.ritense.valtimo:web"
},
"ranges": [
{
"events": [
{
"introduced": "13.0.0"
},
{
"fixed": "13.26.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-44516"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": true,
"github_reviewed_at": "2026-05-11T16:11:06Z",
"nvd_published_at": "2026-05-14T17:16:23Z",
"severity": "HIGH"
},
"details": "### Summary\n\nThe `LoggingRestClientCustomizer` in the `web` module automatically intercepts all outgoing HTTP calls made via Spring\u0027s `RestClient` and logs the full request body, response body, and response headers. When an error response is received, this information is included in the thrown `HttpClientErrorException` message, which is logged at ERROR level by Spring\u0027s default exception handling \u2014 regardless of the application\u0027s DEBUG log level setting.\n\n### Impact\n\nThe logged data can contain highly sensitive information including:\n- Authentication credentials (JWT tokens, API keys, OAuth tokens) in request bodies or response headers\n- Personal data (BSN, email addresses, case details) in request/response bodies\n- Session tokens in `Set-Cookie` response headers\n\nThis data is exposed to:\n- Anyone with access to application logs (stdout/log files)\n- Users with access to logging aggregation tools (e.g. Grafana/Loki)\n- Any Valtimo user with the admin role, through the built-in logging module (since Valtimo 12.5.0)\n\nLeaked authentication credentials could be used to impersonate the Valtimo application against the target external API (e.g. ZGW services), compromising that API\u0027s security boundary.\n\nRelated: GHSA-hfrg-mcvw-8mch (similar sensitive data exposure in InboxHandlingService)\n\n### Affected Code\n\n`com.ritense.valtimo.web.logging.LoggingRestClientCustomizer#intercept` in the `web` module.\n\n### Patched Versions\n\nThe vulnerability is fixed in:\n- **12.33.0** (v12 release line) \u2014 see PR #600\n- **13.26.0** (v13 release line) \u2014 see PR #599\n\nThe fix removes the request/response report, headers, and response body from the `HttpClientErrorException` constructor; only the HTTP status code and status text remain. The full request/response report is still emitted at DEBUG level (disabled in production).\n\n### Mitigation\n\nIf you cannot upgrade to a patched version immediately, consider:\n- Restricting access to application logs and the Valtimo logging module\n- Adjusting the log level for `com.ritense.valtimo.web.logging` to WARN or higher (note: this only mitigates the DEBUG logging path; error responses still leak data via the exception message)",
"id": "GHSA-3jh5-rr2q-xfv7",
"modified": "2026-05-14T20:54:40Z",
"published": "2026-05-11T16:11:06Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/valtimo-platform/valtimo/security/advisories/GHSA-3jh5-rr2q-xfv7"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44516"
},
{
"type": "WEB",
"url": "https://github.com/valtimo-platform/valtimo/pull/599"
},
{
"type": "WEB",
"url": "https://github.com/valtimo-platform/valtimo/pull/600"
},
{
"type": "PACKAGE",
"url": "https://github.com/valtimo-platform/valtimo"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Valtimo has sensitive data exposure through HTTP request/response logging in LoggingRestClientCustomizer"
}
GHSA-3JHQ-49PH-54F5
Vulnerability from github – Published: 2021-12-16 00:01 – Updated: 2021-12-18 00:01In OnMetadataChangedListener of AdvancedBluetoothDetailsHeaderController.java, there is a possible leak of Bluetooth MAC addresses due to log information disclosure. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-181588752
{
"affected": [],
"aliases": [
"CVE-2021-0991"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-12-15T19:15:00Z",
"severity": "LOW"
},
"details": "In OnMetadataChangedListener of AdvancedBluetoothDetailsHeaderController.java, there is a possible leak of Bluetooth MAC addresses due to log information disclosure. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-181588752",
"id": "GHSA-3jhq-49ph-54f5",
"modified": "2021-12-18T00:01:22Z",
"published": "2021-12-16T00:01:07Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-0991"
},
{
"type": "WEB",
"url": "https://source.android.com/security/bulletin/pixel/2021-12-01"
}
],
"schema_version": "1.4.0",
"severity": []
}
Mitigation
Consider seriously the sensitivity of the information written into log files. Do not write secrets into the log files.
Mitigation
Remove debug log files before deploying the application into production.
Mitigation
Protect log files against unauthorized read/write.
Mitigation
Adjust configurations appropriately when software is transitioned from a debug state to production.
CAPEC-215: Fuzzing for application mapping
An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes the application's log or error messages returned. The attacker does not initially know how a target will respond to individual messages but by attempting a large number of message variants they may find a variant that trigger's desired behavior. In this attack, the purpose of the fuzzing is to observe the application's log and error messages, although fuzzing a target can also sometimes cause the target to enter an unstable state, causing a crash.