CVE Watch16 de out. de 2026

CVE-2026-110248

Insertion of sensitive information into log files in the git_utils[.]py component in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 bef

CVSS

5.3

Média

EPSS

0.5%

p45

KEV

—

Exploit Today

0-100

Publicado: 14 de out. de 2026 · Última mod.: 16 de out. de 2026 · CWE-532

EPSS · 30d

0.5%EPSS · 30 dias0.5%

2026-10-152026-11-06

Descrição técnica

Insertion of sensitive information into log files in the git_utils[.]py component in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 before 2.257.3 might allow an authenticated remote user to obtain plaintext repository credentials from CloudWatch Logs when a git clone operation fails, because the runclone_command() function does not redact credentials from subprocess error output. To remediate this issue, users should upgrade to Amazon SageMaker Python SDK V3 3.10.0 or V2 2.257.3.

Referências oficiais

CVEs relacionados

CVECVSSEPSSKEVRExploitTítuloMod.

CVE-2026-173227.1 ALT

—

———IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a local attacker to obtain sensitive credentials and compromise accounts due to insertion of sensitive information into log files.4h CVE-2026-171286.8 MÉD

—

———IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to the insertion of sensitive information into log files.4h CVE-2026-106019—

—

——0Insertion of sensitive information into log file vulnerability in Johnson Controls C-CURE 9000, Victor allows Use of Known Operating System Credentials. This issue affects C-CURE 9000, Victor: 3.20.12h CVE-2026-1233165.5 MÉD

—

——0In JetBrains Junie CLI before 26.6.29 sensitive environment variables were exposed in session event logs12h CVE-2026-541458.8 ALT

0.3%

——0OpenHuman is an open-source agent harness available as a desktop application and Rust library. In affected versions before 0.57.5, the approval gate uses the JSON-RPC bearer token as an approval session identifier. This exposes the credential through persisted approval records, events, debug logs, and RPC responses, including during normal desktop operation. An attacker who obtains these artifacts can recover the token and access the core RPC interface while it remains valid. This can expose sensitive agent and integration data and permit privileged operations. Stable tokens remain usable until rotated; launch-specific tokens remain usable while the corresponding core instance is active. The fix is included in version 0.57.5.12h CVE-2026-73100—

37.2%

——11Insertion of Sensitive Information into Log File vulnerability in Apache Juneau. The default REST server call logger records request headers for requests that end in a server error, without redacting them. Any client able to cause a server error gets headers such as Authorization, Cookie, Proxy-Authorization and X-API-Key written in cleartext to the application log, exposing them to anyone who can read the logs. This issue affects Apache Juneau: through 9.2.0. Users are recommended to upgrade to version 9.2.1, which fixes the issue.2d