CVE-2026-78242

MediumCVSS 5.7/10Last modified Oct 1, 2026

Description

Insertion of sensitive information into log file vulnerability in Apache APISIX.

This vulnerability can cause the unmasked header value to be written to the log sink under a certain response structure. 

This issue affects Apache APISIX: 3.17.0.

Users are recommended to upgrade to version 3.18.0, which fixes the issue.

Metrics

CVSS 4.0 5.7/10CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-532

Affected software

No affected versions have been published.

Timeline

Published
Oct 1, 2026
Last modified
Oct 1, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-782432.1Apache YuniKorn 1.8.0 and later, if configured with the LDAP group resolver, crashes due to an out of bounds read processing group membershiCVE-2026-782447.3A vulnerability was detected in itsourcecode Real Estate Management System 1.0. Affected by this issue is some unknown functionality of the CVE-2026-782457.3A flaw has been found in itsourcecode Online Pharmacy System 1.0. This affects the function move_uploaded_file of the file all_users/registeCVE-2026-782467.3A vulnerability has been found in itsourcecode Online Clinic Management System 1.0. This vulnerability affects unknown code of the file succCVE-2026-782477.3A vulnerability was found in SourceCodester Simple Online Food Ordering System 1.0. This issue affects some unknown processing of the file /CVE-2026-782487.3A vulnerability was determined in SourceCodester Simple Online Food Ordering System 1.0. Impacted is an unknown function of the file /fos/adCVE-2026-782496.8A path traversal vulnerability exists in the web management interface of multiple Multifunction Devices and Printers, including Apeos C4571 CVE-2026-782504.3A vulnerability was identified in bytebot-ai bytebot 0.0.1. The affected element is an unknown function of the component Agent Execution WorCVE-2026-782519.3DJI drones contain an FTP service that uses hardcoded credentials shared across affected models and permits authenticated users to upload fiCVE-2026-782526.1GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.3 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 thCVE-2026-782532.3Uncontrolled recursion in QXmlStreamReader::readElementText() in Qt Group Qt allows attackers to cause a denial of service (application crasCVE-2026-782547.4The ftp and scp tasks of Apache Ant can download files from a remote server. A malicious server can provide relative paths that allow it to
CVE-2026-78242: Medium severity, CVSS 5.7 | Vulnix