CVE-2026-103371 - Vulnerability Details - OpenCVE

Insertion of Sensitive Information into Log File in Apache Geode Web Management. This issue affects Apache Geode: from 2.0.0 before 2.0.3. Users are recommended to upgrade to version 2.0.3, which fixes the issue.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Apache	Geode

No data.

No data.

References

Link	Providers
http://www.openwall.com/lists/oss-security/2026/10/07/29
https://lists.apache.org/thread.html/fdkxh4z718pjp74skvgfsbhcby59lzog

History

Fri, 09 Oct 2026 09:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Apache Apache geode
Vendors & Products		Apache Apache geode

Thu, 08 Oct 2026 19:00:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-200

Thu, 08 Oct 2026 18:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 08 Oct 2026 17:30:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}`

Wed, 07 Oct 2026 21:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-200 CWE-532

Wed, 07 Oct 2026 19:30:00 +0000

Type	Values Removed	Values Added
References		http://www.openwall.com/lists/oss-security/2026/10/07/29

Wed, 07 Oct 2026 19:00:00 +0000

Type	Values Removed	Values Added
Description		Insertion of Sensitive Information into Log File in Apache Geode Web Management. This issue affects Apache Geode: from 2.0.0 before 2.0.3. Users are recommended to upgrade to version 2.0.3, which fixes the issue.
Title		Apache Geode: Management REST API: Insertion of Sensitive Information into Log File
References		https://lists.apache.org/thread.html/fdkxh4z718pjp74skvgfsbhcby59lzog

MITRE

Status: PUBLISHED

Assigner: apache

Published: 2026-10-07T18:46:38.719Z

Updated: 2026-10-08T17:12:22.037Z

Reserved: 2026-09-30T13:03:35.003Z

Link: CVE-2026-103371

Vulnrichment

Updated: 2026-10-07T19:07:38.142Z

NVD

Status : Awaiting Analysis

Published: 2026-10-07T19:17:31.453

Modified: 2026-10-08T17:26:22.830

Link: CVE-2026-103371

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-103371", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-09-30T13:03:35.003Z", "datePublished": "2026-10-07T18:46:38.719Z", "dateUpdated": "2026-10-08T17:12:22.037Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-10-07T18:46:38.719Z"}, "title": "Apache Geode: Management REST API: Insertion of Sensitive Information into Log File", "source": {"discovery": "UNKNOWN"}, "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Geode", "packageURL": "pkg:maven/org.apache.geode/geode-web-management", "versions": [{"status": "affected", "version": "2.0.0", "lessThan": "2.0.3", "versionType": "semver"}], "defaultStatus": "unaffected", "collectionURL": "https://repo.maven.apache.org/maven2", "packageName": "org.apache.geode:geode-web-management"}], "descriptions": [{"value": "Insertion of Sensitive Information into Log File in Apache Geode Web Management.\n\n\n\nThis issue affects Apache Geode: from 2.0.0 before 2.0.3.\n\n\n\nUsers are recommended to upgrade to version 2.0.3, which fixes the issue.", "lang": "en", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Insertion of Sensitive Information into Log File in Apache Geode Web Management.</p><p>This issue affects Apache Geode: from 2.0.0 before 2.0.3.</p><p>Users are recommended to upgrade to version 2.0.3, which fixes the issue.</p>"}]}], "references": [{"url": "https://lists.apache.org/thread.html/fdkxh4z718pjp74skvgfsbhcby59lzog", "tags": ["vendor-advisory"]}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "moderate"}}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "credits": [{"lang": "en", "value": "Wanxin Yin / yaklang.io", "type": "finder"}], "x_generator": {"engine": "Vulnogram 1.0.3"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/10/07/29"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-10-07T19:07:38.142Z"}}, {"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-532", "lang": "en", "description": "CWE-532 Insertion of Sensitive Information into Log File"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-10-08T17:12:13.068434Z", "id": "CVE-2026-103371", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-08T17:12:22.037Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-103371", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-09-30T13:03:35.003Z", "datePublished": "2026-10-07T18:46:38.719Z", "dateUpdated": "2026-10-08T17:12:22.037Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-10-07T18:46:38.719Z"}, "title": "Apache Geode: Management REST API: Insertion of Sensitive Information into Log File", "source": {"discovery": "UNKNOWN"}, "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Geode", "packageURL": "pkg:maven/org.apache.geode/geode-web-management", "versions": [{"status": "affected", "version": "2.0.0", "lessThan": "2.0.3", "versionType": "semver"}], "defaultStatus": "unaffected", "collectionURL": "https://repo.maven.apache.org/maven2", "packageName": "org.apache.geode:geode-web-management"}], "descriptions": [{"value": "Insertion of Sensitive Information into Log File in Apache Geode Web Management.\n\n\n\nThis issue affects Apache Geode: from 2.0.0 before 2.0.3.\n\n\n\nUsers are recommended to upgrade to version 2.0.3, which fixes the issue.", "lang": "en", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Insertion of Sensitive Information into Log File in Apache Geode Web Management.</p><p>This issue affects Apache Geode: from 2.0.0 before 2.0.3.</p><p>Users are recommended to upgrade to version 2.0.3, which fixes the issue.</p>"}]}], "references": [{"url": "https://lists.apache.org/thread.html/fdkxh4z718pjp74skvgfsbhcby59lzog", "tags": ["vendor-advisory"]}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "moderate"}}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "credits": [{"lang": "en", "value": "Wanxin Yin / yaklang.io", "type": "finder"}], "x_generator": {"engine": "Vulnogram 1.0.3"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/10/07/29"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-10-07T19:07:38.142Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-103371", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-08T17:12:13.068434Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-532", "description": "CWE-532 Insertion of Sensitive Information into Log File"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-08T17:11:36.266Z"}}]}}