CVE-2026-78242CWE-532

CVE-2026-78242

published October 1, 2026

CVSS
5.7
EPSS
0%
Percentile
4.0
In the wild
Unconfirmed
What it is

Insertion of sensitive information into log file vulnerability in Apache APISIX.

This vulnerability can cause the unmasked header value to be written to the log sink under a certain response structure.

This issue affects Apache APISIX: 3.17.0.

Users are recommended to upgrade to version 3.18.0, which fixes the issue.

The record
Technical detail
CVSS
5.7 · NONE
CVSS v4.0
5.7 · CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00152 · 4.0th percentile
Weakness
CWE-532 · Insertion of Sensitive Information into Log File
Published
2026-10-01T15:17Z
References (2)
https://lists.apache.org/thread.html/qxzsyw1pbgxg4sqkc4t2g8h4w2q0mvsn · [email protected]http://www.openwall.com/lists/oss-security/2026/10/01/2 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 03 OCT 03:46Z
    EPSS moved — → 0%
    epss
  • 01 OCT 10:58Z
    Apache APISIX: data-mask may fail to redact request headers in logger output
    cvelistv5