What is the CVSS score of CVE-2026-32598?

CVE-2026-32598 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Kubernetes are affected by CVE-2026-32598?

Organizations using OneUptime should be aware of notable risk from CVE-2026-32598, a log file exposure vulnerability rated CVSS 6.5. This could allow unauthorized file access.. A patch is available.

How to fix or mitigate CVE-2026-32598?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Review data exposure and access controls.

Kubernetes CVE-2026-32598

EUVD-2026-11730 MEDIUM

Insertion of Sensitive Information into Log File (CWE-532)

2026-03-13 security-advisories@github.com

GHSA-4524-cj9j-g4fj

Kubernetes Docker Information Disclosure Oneuptime

6.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 13, 2026 - 20:00 euvd

EUVD-2026-11730

Analysis Generated

Mar 13, 2026 - 20:00 vuln.today

CVE Published

Mar 13, 2026 - 19:55 nvd

MEDIUM 6.5

DescriptionGitHub Advisory

OneUptime is a solution for monitoring and managing online services. Prior to 10.0.24, the password reset flow logs the complete password reset URL - containing the plaintext reset token - at INFO log level, which is enabled by default in production. Anyone with access to application logs (log aggregation, Docker logs, Kubernetes pod logs) can intercept reset tokens and perform account takeover on any user. This vulnerability is fixed in 10.0.24.

AnalysisAI

OneUptime versions prior to 10.0.24 contain a sensitive information exposure vulnerability where the password reset flow logs complete password reset URLs containing plaintext reset tokens at the INFO log level, which is enabled by default in production environments. Any actor with access to application logs-including log aggregation systems, Docker logs, or Kubernetes pod logs-can extract these tokens and perform account takeover on any user. The vulnerability is fixed in version 10.0.24.

Technical ContextAI

This vulnerability is rooted in CWE-532 (Insertion of Sensitive Information into Log File), a common but critical weakness in application logging practices. OneUptime, a monitoring and online service management platform, implements a password reset mechanism that generates time-limited reset tokens and constructs a password reset URL containing this token in plaintext. The application logs this complete URL at INFO severity level during the reset flow execution. Since INFO-level logging is enabled by default in production deployments, the sensitive reset token persists in multiple log storage layers: in-container Docker logs accessible via the Docker daemon, Kubernetes pod logs stored in kubelet's log directory and accessible through kubectl commands, and centralized log aggregation systems (ELK, Splunk, CloudWatch, etc.) where logs are often stored for extended periods. The vulnerability affects OneUptime prior to version 10.0.24 (CPE: cpe:2.3:a:oneuptime:oneuptime). The root cause is insufficient log sanitization at the application layer combined with overly permissive log level defaults that expose security-critical data.

RemediationAI

The primary remediation is to upgrade OneUptime to version 10.0.24 or later immediately. For organizations unable to patch immediately, implement compensating controls: set the log level to WARN or ERROR (disabling INFO-level logging) in production environments to prevent the logging of sensitive reset URLs; restrict access to logs and log aggregation systems using role-based access control (RBAC) and limit log access to security teams only; rotate all existing password reset tokens by forcing a re-generation of any in-flight reset URLs; audit log retention policies and purge logs older than 7 days containing sensitive reset tokens; and implement log sanitization rules in any centralized log aggregation platform to mask or redact reset tokens and URLs matching the pattern. Monitor for signs of token extraction or unusual account access during the patching window. The vendor advisory is available at https://github.com/OneUptime/oneuptime/releases/tag/v10.0.24.