CVE-2026-104872

Multiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attribute

OpenTelemetry JavaScript Contrib provides instrumentation libraries for collecting telemetry from JavaScript applications. Prior to versions 0.66.0 of @opentelemetry/instrumentation-cassandra-driver, 0.65.0 of @opentelemetry/instrumentation-knex, 0.67.0 of @opentelemetry/instrumentation-mongoose, @opentelemetry/instrumentation-mysql, and @opentelemetry/instrumentation-mysql2, 0.46.0 of @opentelemetry/instrumentation-oracledb, 0.73.0 of @opentelemetry/instrumentation-pg, and 0.40.0 of @opentelemetry/instrumentation-tedious, the packages add the database connection username to every instrumented database operation as the db.user span attribute. The attribute is emitted by default and is not controlled by enhancedDatabaseReporting or another opt-in setting. Configured observability backends therefore receive database account names that may expose service topology, role or environment information, and account naming patterns. This issue is fixed in versions 0.66.0, 0.65.0, 0.67.0, 0.46.0, 0.73.0, and 0.40.0 of the respective packages.

CVSS 3.1 · 5.8 Medium EPSS < 1% KEV · Not listed

Vendors

Open-telemetry Opentelemetry

Products

Opentelemetry-js-contrib Instrumentation-cassandra-driver Instrumentation-knex and 6 more

CVE-2026-104055

Monitoring-user password logged in cleartext by postgres_exporter in postgresql VM charm

The postgresql-operator charm runs a Prometheus postgres_exporter to collect database metrics using a dedicated "monitoring" PostgreSQL user. On database connection errors, the exporter writes the monitoring user's password in cleartext to its logs. Any actor able to read those logs can recover the password, which grants read-only pg_monitor access to PostgreSQL. This is fixed in the dev track (14/edge) in revisions 1189 (arm64) and 1190 (amd64), and in the stable track (14/stable) in revisions 1216 (arm64) and 1217 (amd64).

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Canonical

Products

Postgresql-operator

CVE-2026-94594

Armatura LLC Armatura One Insertion of Sensitive Information into Log File

Armatura One's message broker logs client connection credentials and the associated password in plain text during normal operation. Any party with read access to this log, or to a backup or support bundle that includes it, can obtain the logged credential.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Armatura

Products

Armatura One Armatura One (usa)

CVE-2026-94593

Armatura LLC Armatura One Insertion of Sensitive Information into Log File

Armatura One's backup and restore routine records the full database connection command, including the superuser password, in plain text in a log file on the host. Credentials disclosed by this finding can be used to access the database when access to the server operating system is available.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Armatura

Products

Armatura One Armatura One (usa)

CVE-2026-93982

OpenPanel through 2.3.0 MCP Authentication Token in Query Parameter Logged Plaintext

OpenPanel through 2.3.0 writes Model Context Protocol authentication tokens from URL query parameters to plaintext application logs without redaction. Attackers with access to application stdout or centralized logging systems can capture base64-encoded credentials to replay MCP requests and access project analytics.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Openpanel

Products

Openpanel

CVE-2026-78242

Apache APISIX: data-mask may fail to redact request headers in logger output

Insertion of sensitive information into log file vulnerability in Apache APISIX. This vulnerability can cause the unmasked header value to be written to the log sink under a certain response structure.  This issue affects Apache APISIX: 3.17.0. Users are recommended to upgrade to version 3.18.0, which fixes the issue.

CVSS 4.0 · 5.7 Medium EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Apisix

CVE-2026-81715

openssl_encrypt before 1.4.9 Credential Exposure via Debug Output

openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8 do not redact the keyserver bearer token passed as the positional argument to 'keyserver set-token' in the --debug argv dump, because sanitize_argv_for_debug fails to sanitize it. As a result the token is printed in cleartext to stderr under --debug (even without --unsafe-show-secrets), persisting the credential in logs and terminal history. Fixed in 1.4.9.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Jahlives

Products

Openssl Encrypt

CVE-2026-81705

openssl-encrypt before 1.4.9 Password Cleartext Leak via Debug

openssl-encrypt before 1.4.9 fails to redact the file password in its --debug argv dump when the password is supplied via bundled short-option spellings (e.g. -apHunter2) or abbreviated long-option spellings (e.g. --passw). The sanitizer only recognized exact option names, --option=value forms, and tokens starting with -p, so these spellings bypass the redaction chokepoint and the cleartext password is written to stderr. Anyone with access to that output (terminal scrollback, merged 2>&1 output, CI job logs, or the GUI's persistent debug log) can recover the password.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Jahlives

Products

Openssl Encrypt

CVE-2026-74870

openssl_encrypt before 1.4.8 Hardware Pepper Information Disclosure

openssl_encrypt (pip) versions <= 1.4.7 contain an information exposure vulnerability where the 'hsm fido2-test' and 'hsm onlykey-test' diagnostic commands unconditionally print the full derived hardware pepper as hex to stdout/stderr (crypt_cli.py, handle_hsm_command). The printed value can persist in terminal scrollback, session recordings, or CI logs. Impact is limited because the pepper is derived from a random per-invocation test salt and is salt-bound, so the leaked value cannot be used to decrypt real files. A related plugin issue logged raw prf_data outside the secret-redaction path. Fixed in 1.4.8 (and 1.5.0) by removing the hex dumps and routing plugin debug output through the redaction layer.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Jahlives

Products

Openssl Encrypt

CVE-2026-92872

pgpool-II: pgpool-II: Information disclosure via log files

Pgpool-II inserts sensitive information into log file, which may allow an authenticated attacker to obtain the cluster information.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Pgpool Global Development Group

Products

Pgpool-ii

CVE-2025-71425

Contrast before 1.8.1 Information Disclosure via Logging

Contrast (Edgeless Systems) before 1.8.1 logs the workload secret to stderr, and thus to Kubernetes logs, when the Contrast initializer is configured with CONTRAST_LOG_LEVEL set to info or debug. Because info is the default, all installations that do not customize the initializer log level are affected. This exposes workload secrets — normally accessible only to the Contrast Coordinator, the initializer, the seedshare owner, and the workload owner — to Kubernetes users with get or list permission on pods/logs and to anyone with read access to the Kubernetes log storage, such as the cloud provider. Deployments that do not use workload secrets are unaffected.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Edgelesssys

Products

Contrast

CVE-2026-19502

Insufficient redaction of sensitive configuration values in diagnostic output of MongoDB SQL Schema Builder CLI

MongoDB SQL Schema Builder CLI records its startup configuration to standard output and, when file logging is enabled, to a log file on disk. Certain connection settings were written without redaction, so authentication material supplied by the operator could appear in plaintext in that diagnostic output. A local user with read access to the terminal session or the log directory, or anyone with access to a location where those logs are subsequently collected, could obtain those values.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Mongodb

Products

Schema Builder Cli Sql Schema Builder Cli

CVE-2026-81530

KMS master key exposure via unredacted credential serialization in driver settings string

A weakness in the client-side encryption configuration surface of the MongoDB C# Driver causes sensitive key-management credential material supplied by the application to be reproduced verbatim in the driver's human-readable diagnostic representation of its client settings, instead of being masked as other secret fields are. A party able to read the application's logs, diagnostic output, or a process memory dump may thereby recover the plaintext credentials and use them to decrypt protected field data.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Mongodb

Products

C# Driver C\# Driver

CVE-2025-71423

Edgelesssys Contrast before 1.12.2 Workload Secrets Information Disclosure

Edgelesssys Contrast is a confidential-computing runtime for Kubernetes. In versions 1.9.0 before 1.12.2, the initializer logs the full NewMeshCert response — which contains the workload secret — to standard output at INFO level. As a result, workload secrets are exposed to any Kubernetes user with get or list permission on pods/logs. Because workload secrets are used for encrypted storage and Vault integration, those must also be considered compromised. This is a regression of GHSA-h5f8-crrq-4pw8.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Edgelesssys

Products

Contrast

CVE-2026-87779

Apache Syncope: AES Secret Key disclosure via log output

Insertion of sensitive information into log file vulnerability in Apache Syncope. When AES key of non-standard length (not 16/24/32 bytes) is configured, Syncope will pad the provided value with random characters. The resulting key value is logged. This issue affects Apache Syncope: from 3.0.15 through 3.0.16, from 4.0.3 through 4.0.7, from 4.1.0-M0 through 4.1.2. Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Syncope

CVE-2026-63208

Zammad: Microsoft Graph error logs expose partially masked OAuth access tokens

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when a Microsoft Graph request fails, Zammad logs the error including the authentication token used to access the mailbox. The system attempts to hide this token in the log, but the masking is incomplete: for the token format Microsoft uses (JWT), only the first part is hidden, while the remaining parts remain readable in plain text. A Zammad admin with Microsoft Graph channel access can view these logs and see the partial token, which may reveal sensitive claims such as the account scope, tenant, or timing, and could assist in reconstructing the full token while it is still valid. This issue is fixed in version 7.1.2.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Zammad

Products

Zammad

CVE-2026-82716

Botslab G980H Dashcams Insertion of Sensitive Information into Log File

The Botslab G980H dash camera firmware includes sensitive configuration information, including WiFi credentials, in diagnostic logs generated during the support process. These logs remain accessible on removable storage after the support operation has completed. An unauthenticated attacker with physical access to the storage media could retrieve the logs and obtain sensitive device information.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Botslab

Products

G980h

CVE-2026-14443

Incomplete log sanitization during bulk IPsec policy collection in Brocade SANnav before 3.0.1a

Incomplete log sanitization during bulk IPsec policy collection in Brocade SANnav versions before 3.0.1a permit extension switch pre-shared keys to be written to system logs. Individuals with read access to container logs or support archives can obtain these keys, leading to the potential compromise of encrypted network tunnels.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Brocade

Products

Sannav

CVE-2026-85417

Incomplete property masking in the SANnav logging subsystem

Incomplete property masking in the SANnav logging subsystem permits SNMP authentication and privacy passwords to be recorded in application logs under specific configuration conditions. Individuals with read access to system logs or support bundles can retrieve these credentials, leading to unauthorized read or management access to monitored switch environments

CVSS 4.0 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Brocade

Products

Sannav

CVE-2026-18710

Cleartext Storage of Sensitive Information in MongoDB Driver Logging During Client Initialization

A MongoDB driver component could write sensitive configuration information, including a credential used for outbound network connectivity, to application log output in cleartext during routine client initialization. This occurs automatically as part of normal operation and requires no special privileges to trigger. A party able to read the affected application's logs or downstream log-aggregation storage could recover the credential and reuse it to authenticate to the associated network infrastructure. This issue affects confidentiality only.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Mongodb

Products

Java Driver Mongodb Server