CWE-201: Insertion of Sensitive Information Into Sent Data

The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.

Consequences

• Confidentiality: Read Files or Directories, Read Memory, Read Application Data

How to prevent it

• Requirements: Specify which data in the software should be regarded as sensitive. Consider which types of users should have access to which types of data.
• Implementation: Ensure that any possibly sensitive data specified in the requirements is verified with designers to ensure that it is either a calculated risk or mitigated elsewhere. Any information that is not necessary to the functionality should be removed in order to lower both the overhead and the possibility of security sensitive data being sent.
• System Configuration: Setup default error messages so that unexpected errors do not disclose sensitive information.
• Architecture and Design: Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.

Recent advisories

• GHSA-wxxw-5cvc-53j7 — Microsoft Security Advisory CVE-2026-66822 - .NET and Visual Studio Information Disclosure Vulnerability
• GHSA-g2v8-7jhw-pp8p — Backstage: Sensitive information exposure in Scaffolder
• GHSA-238x-w2j9-gwwr — Payload vulnerable to API key disclosure through ordinary document reads
• GHSA-p78m-89r6-pgf7 — Open WebUI: A user's session cookies are sent to tool servers configured for bearer authentication
• GHSA-vx52-2968-3vc6 — pnpm: Environment secrets exfiltrated via env-placeholder expansion in proxy settings read from an untrusted pnpm-workspace.yaml
• GHSA-955p-x3mx-jcvp — Next.js: Unauthenticated disclosure of internal Server Function endpoints
• GHSA-rwj8-pgh3-r573 — GitPython: Environment-variable exfiltration via os.path.expandvars() on Repo.clone_from() URL
• GO-2026-5856 — Invoking Encrypted Client Hello privacy leak in crypto/tls
• GHSA-3qhv-2rgh-x77r — pnpm: Repository config can expand victim environment secrets into registry requests before scripts run
• GHSA-9p44-r552-4wp9 — Mattermost doesn't sanitize the Remote Cluster API response on PATCH operations
• GHSA-p92q-9vqr-4j8v — Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter
• GHSA-j5f8-grm9-p9fc — Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection
• GHSA-g35p-px32-whv6 — MLflow: Environment variable injection in AI Gateway secrets enables server-side credential exfiltration
• GHSA-q3w6-q3hc-c5x6 — FUXA's Unauthenticated Project Data Disclosure Exposes Server-Side Scripts and Device Configurations
• GHSA-ggw7-9675-6v4v — MantisBT has an authorization bypass in private issue monitoring

All advisories for CWE-201