EUVD-2026-94553
GHSA-6jj6-p3qg-5mp6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Geode Web Management interface
-
ExploitTrigger operation that logs secrets
-
ExecutionRetrieve exposed log content
-
ImpactHarvest disclosed sensitive data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A09:2025 - Security Logging & Alerting Failures
ASVS 5.0
V16 - Security Logging and Error Handling Log data sanitization
|
| Exploitation Conditions | Exploitation targets the Apache Geode Web Management component, which inserts sensitive information into log files (CWE-532). The concrete prerequisite is that an affected version (2.0.0 up to but not including 2.0.3) is deployed with the Web Management interface in use. The realistic limiting factor is access to the generated log data: classic CWE-532 exploitation requires the attacker to read the log files or any interface that surfaces them, so despite the CVSS AV:N/PR:N labeling, practical impact depends on whether the Web Management interface actually exposes the logged secrets to an unauthenticated network caller. If logs are only accessible to local/privileged operators, real-world exploitability is substantially lower than the 7.5 score suggests. |
| Impact | This is a moderate-priority information-disclosure flaw (CWE-532) in Apache Geode Web Management, rated CVSS 7.5 with vector AV:N/AC:L/PR:N/UI:N/C:H. The signals are largely low-urgency: EPSS is only 0.17% (6th percentile), the CVE is not listed in CISA KEV, and no public exploit code was identified in the provided sources, indicating no evidence of active or imminent exploitation. Note a meaningful tension between the metadata and the vulnerability class: CWE-532 (sensitive information written to log files) typically requires an attacker to be able to READ those logs, which is usually a local or privileged-access condition, yet the published CVSS vector asserts AV:N and PR:N (remote, unauthenticated). This AV:N/PR:N framing likely reflects that the Web Management interface may expose or return the logged sensitive data over the network, but it is not fully substantiated by the one-line description - verify the exact exposure path with the Apache advisory before treating this as a true remote-unauthenticated data leak. Overall: a legitimate confidentiality issue worth patching, but the combination of low EPSS, no KEV, no POC, and a log-disclosure root cause suggests this is a patch-in-normal-cycle item rather than an emergency. |
| Exploit ScenarioDerived | An attacker interacting with the Apache Geode Web Management interface obtains sensitive information (e.g., credentials or configuration secrets) that the application improperly records into log files. Per the published CVSS vector (AV:N/PR:N), this data may be retrievable remotely without authentication, allowing disclosure of secrets usable for further access. No public proof-of-concept exploit was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 08, 2026
Sensitive information is inserted into log files by the Apache Geode Web Management component in versions 2.0.0 through 2.0.2, so any party able to read those logs can recover the exposed confidential values (CWE-532, high confidentiality impact only). The NVD entry scores this 7.5 under CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, but our independent assessment applies AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - the practical constraint is obtaining access to the generated log output or a UI that surfaces it, so real-world exploitation is materially harder than the 7.5 network-vector score implies and authentication requirements are not settled by the available data. Exploitation is not confirmed actively exploited (CISA KEV does not list this CVE), no public exploit code has been identified at time of analysis, and EPSS is low at 0.17 percent (6th percentile), making this a moderate-priority information-disclosure issue rather than an urgent remote-compromise risk.
Earlier versions of this analysis (1)
Sensitive information handled by the Apache Geode Web Management / Management REST API is written into log files without adequate redaction on versions 2.0.0 through 2.0.2, letting anyone who can read those logs recover confidential values (CWE-532; confidentiality-only impact, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Exploitation is not a network-reachable attack: it requires a deployment that actually uses the Management REST API and processes the affected values, plus an authenticated, low-privileged position with read access to the log store, log-aggregation pipeline, log backups, or the host filesystem where Geode writes its logs; an attacker without log access cannot exploit it. No public exploit code identified at time of analysis, and the issue is rated moderate by the vendor. Remediation is a straightforward upgrade to Apache Geode 2.0.3.
RemediationAI
Vendor-released patch: upgrade to Apache Geode 2.0.3, which the Apache project states fixes the issue, and confirm the upgrade against the advisory at https://geode.apache.org/ and the oss-security posting at https://seclists.org/oss-sec/2026/q4/88 (mirror: http://www.openwall.com/lists/oss-security/2026/10/07/29). Because the flaw is a logging defect, the effective workaround is to constrain who can read the output: tighten filesystem permissions on Geode log directories so only the service account and trusted operators can read them, ship logs to a restricted, access-controlled collector instead of leaving them on shared volumes, and review the log4j/logback configuration to shorten retention and avoid duplicate copies in world-readable locations - the trade-off is reduced operational visibility and a longer mean time to diagnosis for legitimate troubleshooting. If the Web Management interface is not operationally required, disable it or restrict it to an internal management network, since removing that surface also removes any route by which logged data could be surfaced to a network caller; the cost is loss of cluster monitoring and management via that console. Until patching is complete, treat any previously written logs from affected versions as potentially containing secrets: purge or securely archive them, and rotate any credentials, tokens or keys that may have been captured in log output. Note that the published CVSS vector claims PR:N while our assessment applies PR:L, so do not assume the affected logging path is safely reachable without prior access - but also do not assume log files are adequately protected by default.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Apache Geode is a Java-based distributed in-memory data grid and cache, and the affected surface is its Web Management component - the browser-facing management/monitoring layer that operators use to inspect clusters, members, regions and configuration. The root-cause class is CWE-532 (Insertion of Sensitive Information into Log File): the application writes confidentiality-sensitive material into log output without masking, redaction or an appropriate protection level. This is fundamentally a defensive-logging failure rather than a memory-safety or injection bug, which is why the CIA triad is affected only on confidentiality (C:H, I:N, A:N) in both the published and independently assessed vectors. The path-vector disagreement is the key technical nuance: NVD models the flaw as remotely reachable and unauthenticated (AV:N/PR:N), whereas our assessment reduces it to local, authenticated access (AV:L/PR:L) because the attacker must first obtain read access to the log files or to an interface that exposes their contents - the classic CWE-532 exploitation prerequisite. Confidence in the exact exposed data fields is limited because the EUVD/CPE intelligence only provides the version range (Apache Geode 2.0.0 <2.0.3) and no CPE strings were supplied with this record, so the definitive list of what is logged should be confirmed against the vendor advisory.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE-532 log disclosure typically requires some access to read logs, so AV:L and PR:L; impact is confidentiality-only (C:H), with no integrity or availability effect.
Primary rating from Vendor (CNA).
CVSS VectorVendor
Lifecycle Timeline
2Description PRE-NVD
Executive ViewAI
Apache Geode Web Management versions 2.0.0 through 2.0.2 can write sensitive information into log files, exposing confidential values to anyone who can read those logs or access a UI that surfaces them. This is a moderate-priority information-disclosure issue with high confidentiality impact if log or UI access is broad, but no public exploit identified at time of analysis and CISA KEV does not list this CVE. Leadership should care because teams running these versions may have sensitive operational data at risk until they restrict access and apply the vendor patch.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB