CWE-312: Cleartext Storage of Sensitive Information

The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.

Consequences

• Confidentiality: Read Application Data

How to prevent it

• Implementation, System Configuration, Operation: When storing data in the cloud (e.g., S3 buckets, Azure blobs, Google Cloud Storage, etc.), use the provider's controls to encrypt the data at rest. [REF-1297] [REF-1299] [REF-1301]
• Implementation, System Configuration, Operation: In some systems/environments such as cloud, the use of "double encryption" (at both the software and hardware layer) might be required, and the developer might be solely responsible for both layers, instead of shared responsibility with the administrator of the broader system/environment.

Recent advisories

• GHSA-j7qq-vr8c-xvw3 — MLflow CrewAI autologging records LLM provider API keys in logged trace spans
• GHSA-r6w9-259g-gwrv — Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read access
• GHSA-pvgv-gcp7-v38g — Nginx UI: Node Secret Credential Exposure via URL Query Parameter
• GHSA-g5xv-mhgm-v5f6 — MCP Atlassian: OAuth fallback token storage writes plaintext access and refresh tokens with group-readable permissions
• GHSA-88f6-4rjv-x774 — Vikunja: TOTP secret is readable after enrollment, no step-up auth
• EEF-CVE-2026-77970 — Sensitive fields nested in embedded values are not redacted in AshPaperTrail versions
• EEF-CVE-2026-75847 — Sensitive attribute values stored in a non-sensitive public changes map in AshPaperTrail
• PYSEC-2026-3792 — openssl_encrypt (pip package openssl-encrypt) versions 1.4.8 and earlier store an mTLS client private key in cleartext within a world-readable (0644)…
• GHSA-f3c2-j7g8-vpp8 — Apache Airflow Task SDK fails to mask list-shaped JSON Variables
• GHSA-f643-3rc2-j27w — Apache Airflow exposes dict-valued var.json secrets in Rendered Templates
• GHSA-9r8p-h6cc-6qhm — n8n: Google Service Account Private Key Exposed in JWT Header
• GHSA-2f86-9cp8-6hcf — Grav: Admin Backup Zip File Exposes Account Credentials and Configuration Secrets
• GHSA-8f47-4rh3-x44m — Flowise: Bcrypt Password Hash Exposure
• GO-2026-5099 — ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction
• GHSA-gj49-89wh-h4gj — Cillium exposes sensitive information included in the cilium-bugtool debug archive

All advisories for CWE-312