CVE-2026-877797.5HighCWE-532
Apache Syncope: AES Secret Key disclosure via log output
Apache Software Foundation · Apache Syncope
Not in CISA KEVVendor fix available
0.4%probability of exploitation in the next 30 days
37th percentile
050100
Higher than 37% of scored CVEs
7.5HighCVSS
LowMediumHighCrit.
DescriptionNVD
Insertion of sensitive information into log file vulnerability in Apache Syncope. When AES key of non-standard length (not 16/24/32 bytes) is configured, Syncope will pad the provided value with random characters. The resulting key value is logged. This issue affects Apache Syncope: from 3.0.15 through 3.0.16, from 4.0.3 through 4.0.7, from 4.1.0-M0 through 4.1.2. Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.
Coverage1 article · 1 outlet
First in our coverage: SecurityOnline, 16 Sep.
- Apache Syncope Fixes Six Flaws, Including Critical SQL Injection and Sandbox EscapeSecurityOnline · first in our coverage · mentions it in passing
New articles also arrive in the RSS feed.