Skip to content
Log inStart free trial

CWE-532: Insertion of Sensitive Information into Log File

BaseLikelihood of exploit: Medium

The product writes sensitive information to a log file.

Consequences

  • Confidentiality: Read Application Data

How to prevent it

  • Architecture and Design, Implementation: Consider seriously the sensitivity of the information written into log files. Do not write secrets into the log files.
  • Distribution: Remove debug log files before deploying the application into production.
  • Operation: Protect log files against unauthorized read/write.
  • Implementation: Adjust configurations appropriately when software is transitioned from a debug state to production.

Recent advisories

  • GHSA-j7qq-vr8c-xvw3 — MLflow CrewAI autologging records LLM provider API keys in logged trace spans
  • EEF-CVE-2026-105963 — Secret key base exposed in stack trace arguments on wrong-typed Plug.Crypto arguments
  • GHSA-4xvq-3m68-h444 — Backstage has sensitive information exposure in scaffolder task logs
  • GHSA-95p4-vv4g-jxxm — Backstage may expose sensitive information in Scaffolder task failure events
  • GHSA-mfvq-x7vr-rgqg — Backstage: Secret-derived values may be exposed in scaffolder task logs
  • GHSA-444v-8vxr-p36h — OpenBao Agent Writes Secrets to Stdout
  • EEF-CVE-2026-82723 — Actor record with password digest stored in AshAuthentication audit log entries
  • GHSA-8wmf-6v46-5gfg — OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs
  • PYSEC-2026-3964 — openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8 do not redact the keyserver bearer token passed as the positional argument to 'keyserver…
  • PYSEC-2026-3780 — openssl-encrypt before 1.4.9 fails to redact the file password in its --debug argv dump when the password is supplied via bundled short-option spellings (e.g.
  • PYSEC-2026-3956 — openssl_encrypt (pip) versions <= 1.4.7 contain an information exposure vulnerability where the 'hsm fido2-test' and 'hsm onlykey-test' diagnostic commands…
  • GHSA-cjv4-7hp2-2x9h — Apache Airflow bulk endpoints log Variable and Connection secrets in cleartext
  • GHSA-89gh-3pgc-v5h2 — n8n: Custom Header Credential Values Leaked in Plaintext into LLM Node Execution Data
  • GHSA-hgg8-fqqc-vfmw — vLLM: incomplete CVE-2026-22778 fix leaks PIL repr addresses via Anthropic router
  • GHSA-mch8-wf3h-6x88 — Admidio writes session IDs and auto-login cookie values to application logs

All advisories for CWE-532

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor