CVE-2026-126838
A MongoDB Rust Driver component that holds client-side field level encryption settings includes key management service credential material i
CVSS
5.5
Média
EPSS
—
KEV
—
Exploit Today
—
0-100
Publicado: 12 de nov. de 2026 · Última mod.: 12 de nov. de 2026 · CWE-532
Ainda não há histórico EPSS suficiente.
A MongoDB Rust Driver component that holds client-side field level encryption settings includes key management service credential material in its diagnostic formatting output without redaction. An application that records or displays this formatted output may place that material where a party with read access to the application's diagnostic output can see it, which may result in unintended disclosure of key material.
CVECVSSEPSSKEVRExploitTítuloMod.
CVE-2026-47832——
——0The vulnerability lies in the way application credentials are handled within the BOSH deployment.
bosh-openstack-cpi-release: all versions from v55 to v55.0.4 (inclusive)6hCVE-2026-918917.5 ALT—
——0Dell Terraform Provider for PowerStore, versions prior to 1.3.1 , contains a vulnerability that may cause sensitive authentication data to be insufficiently redacted in diagnostic logs. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information exposure.9hCVE-2026-918798.8 ALT—
——0Dell Terraform for ObjectScale and Powerstore, versions prior to 1.1.1 (ObjectScale) and versions 1.2.1 through 1.3.0 (PowerStore) contains an insertion of sensitive information into Log File vulnerability in the client initialization component. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to information exposure and unauthorized access.9hCVE-2026-918725.5 MÉD—
——0Dell Ansible Storage for PowerStore, versions prior to 3.9.0,contains an Insertion of Sensitive Information into Log File vulnerability in the configuration module. A low privileged attacker with local access could potentially exploit this vulnerability, leading to information exposure.9hCVE-2026-1209766.0 MÉD3.1%
——1On affected platforms running Arista EOS with IEEE 802.1X authentication and MACsec using dynamically derived keys, sensitive authentication information may be recorded in diagnostic data during a Smart Switch Upgrade (SSU).
An attacker with administrative access on the device who obtains the affected diagnostic data could recover sensitive authentication information. This could potentially compromise the confidentiality and integrity of traffic protected by MACsec on the affected link.
The vulnerability is only exposed during and after an SSU reload where an active 802.1X session used for MACsec is present.8hCVE-2026-1207927.3 ALT36.7%
——11Insertion of sensitive information into log file in Aspire allows an authorized attacker to disclose information locally.2d