CWEweakness
CWE-532 Insertion of Sensitive Information into Log File
Medium
Official page ↗
- Abstraction
- Base
- Structure
- Simple
- Status
- Incomplete
- Likelihood of exploit
- Medium
- Languages
- Go, Not Language-Specific, Python
- CWE version
- 5.0
Description
The product writes sensitive information to a log file.
Common consequences
• Confidentiality: Read Application Data — Logging sensitive user data, full path names, or system information often provides attackers with an additional, less-protected path to acquiring the information.
Potential mitigations
• [Architecture and Design, Implementation] Consider seriously the sensitivity of the information written into log files. Do not write secrets into the log files.
• [Distribution] Remove debug log files before deploying the application into production.
• [Operation] Protect log files against unauthorized read/write.
• [Implementation] Adjust configurations appropriately when software is transitioned from a debug state to production.
Detection methods
• Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
Observed examples
• CVE-2017-9615: verbose logging stores admin credentials in a world-readable log file
• CVE-2018-1999036: SSH password for private key stored in build log
Related
Attack pattern · CAPEC (1)
- CAPEC-215 Fuzzing for application mapping attack pattern
Observed example · CVE (2)
- CVE-2018-1999036 An exposure of sensitive information vulnerability exists in Jenkins SSH Agent Plugin 1.15 and earlier in SSHAgentStepExecution.java that… vulnerability
- CVE-2017-9615 Password exposure in Cognito Software Moneyworks 8.0.3 and earlier allows attackers to gain administrator access to all data, because… vulnerability
Child of · CWE (2)
Referenced by CAPEC · weakness (1)
- CAPEC-215 Fuzzing for application mapping attack pattern
Referenced by CVE · weakness (1,315)
- CVE-2026-90861 Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows may expose a user's password in clear text to another… vulnerability
- CVE-2026-118647 n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 saves the SeaTable Trigger node's API token in error execution data,… vulnerability
- CVE-2026-79656 A user with read access to Grafana's server logs, or to a log store they are shipped to, can recover the OAuth and OIDC access, refresh and… vulnerability
- CVE-2026-108325 Tanium addressed an insertion of sensitive information into log file vulnerability in Reputation. vulnerability
- CVE-2026-108328 Tanium addressed an insertion of sensitive information into log file vulnerability in Threat Response. vulnerability
- CVE-2026-114409 Docker Desktop before version 4.97.0 could write third-party API keys and OAuth access tokens in cleartext to local application logs and… vulnerability
- CVE-2026-116691 MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. vulnerability
- CVE-2026-116814 OpenPanel before 3.0.0 contains an information exposure vulnerability that writes database connection URLs and email template data to… vulnerability
- CVE-2026-117341 In affected versions of Octopus Server, creating a user invitation writes the invitation code to the audit event log. vulnerability
- CVE-2026-112250 A vulnerability has been identified in BRAIN2 versions up to and including version 3.09. vulnerability
- CVE-2026-105963 Externally-Generated Error Message Containing Sensitive Information vulnerability in plug_crypto in elixir-plug plug_crypto allows an… vulnerability
- CVE-2026-115657 When used as an executor in either KNIME Server or KNIME Business Hub, KNIME Analytics Platform LTS versions before 5.8.4 log configured… vulnerability
- CVE-2026-115885 The LangGraph CLI is the official command-line interface for LangGraph. vulnerability
- CVE-2026-54711 pghoard is a PostgreSQL backup daemon and restore tooling that stores backup data in cloud object stores. vulnerability
- CVE-2026-115358 OpenBao before 2.6.3 contains an information disclosure vulnerability that allows attackers to leak sensitive data into audit logs by… vulnerability
- CVE-2026-16648 Insertion of Sensitive Information into Log File vulnerability in Drupal Mailer Plus Log allows Remote Services with Stolen Credentials. vulnerability
- CVE-2026-96293 A cleartext storage of sensitive information vulnerability in WatchGuard Endpoint Security's Full Disk Encryption feature for macOS allows… vulnerability
- CVE-2026-113799 Slack Morphism is a client library for Slack Web/Events API/Socket Mode and Block Kit. vulnerability
- CVE-2026-114073 Trigger.dev CLI before 4.5.9 contains an information disclosure vulnerability that exposes resolved environment secret values in debug… vulnerability
- CVE-2026-114471 Insertion of sensitive information into a log file in the SMTP server of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a local… vulnerability
- CVE-2026-111762 A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. vulnerability
- CVE-2026-64943 Insertion of Sensitive Information into Log File vulnerability in Apache Answer. vulnerability
- CVE-2026-85260 Insertion of Sensitive Information into Log File vulnerability in Apache Camel MLLP component. vulnerability
- CVE-2026-19600 Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to sanitize authentication tokens before… vulnerability
- CVE-2026-109968 A flaw was found in the clevis PKCS#11 pin. vulnerability
- CVE-2026-110248 Insertion of sensitive information into log files in the git_utils[.]py component in Amazon SageMaker Python SDK V3 before 3.10.0 and V2… vulnerability
- CVE-2026-76113 Dell Terraform Provider for Redfish, versions 1.1.0 through 1.6.1, contains an Exposure of Sensitive Information to an Unauthorized Actor… vulnerability
- CVE-2026-91883 Dell Terraform Provider for OME, versions 1.0.0 through 1.2.3, contains an Insertion of Sensitive Information into Log File vulnerability… vulnerability
- CVE-2026-101168 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.0 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2… vulnerability
- CVE-2026-106035 An Information Exposure Through Log Files vulnerability in Ivanti Xtraction Cloud Sync before version 2026.4 allows a remote authenticated… vulnerability
Referenced by CWE · has member (1)
- CWE-1468 Weaknesses Addressed by the OWASP Golang Secure Coding Practices Guide view