CVE-2026-44105CWE-532
Cleartext password in logs
Medium · published July 30, 2026
What it is
The credentials for the local user "user-app" may be exposed in log files, potentially enabling a low-privileged local attacker with access to the logs to authenticate via SSH as the limited user "user-app". Charging could be interrupted.
The record
Technical detail
- CVSS v4.0
- 5.8 · MEDIUM
- Vector
- CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
- EPSS
- 0.00135 · 2.7th percentile
- Weakness
- CWE-532 · Insertion of Sensitive Information into Log File
- Published
- 2026-07-30T06:53Z
EPSS history
Timeline