CVE-2026-87779
Insertion of sensitive information into log file vulnerability in Apache Syncope. When AES key of non-standard length (not 16/24/32 bytes) is configured, Syncope will pad the provided value with random characters. The resulting key value is logged. This issue affects Apache Syncope: from 3.0.15 through 3.0.16, from 4.0.3 through 4.0.7, from 4.1.0-M0 through 4.1.2. Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.
Scoring
- Severity
- HIGH
- CVSS base score
- 7.5
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- EPSS probability
- 0.41%
- CWE
- CWE-532
- Published
- 2026-09-14
- Last modified
- 2026-09-14
Affected products
- Apache Software Foundation Apache Syncope
- Apache Software Foundation Apache Syncope
- Apache Software Foundation Apache Syncope
Weakness type
Related vulnerabilities
- CVE-2026-22778 — vLLM leaks a heap address when PIL throws an error
- CVE-2025-14437 — Hummingbird <= 3.18.0 - Unauthenticated Sensitive Information Exposure via Log File
- CVE-2026-5128 — A sensitive information exposure vulnerability exists in ArthurFiorette steam-trader 2.1.1. An unauthenticated attacker
- CVE-2025-11008 — CE21 Suite <= 2.3.1 - Unauthenticated Sensitive Information Exposure to Privilege Escalation
- CVE-2026-25813 — PlaciPy Exposes Sensitive Data via Application Logs
- CVE-2026-23493 — Pimcore ENV Variables and Cookie Informations are exposed in http_error_log
- CVE-2026-82434 — Apache Storm Nimbus, Apache Storm Client: Disclosure of the Topology ZooKeeper Credential to Read-Only Users and to Logs
- CVE-2026-49200 — Acer Wave 7 router: Broken Access Control