rootpwn

high · CVSS v3 7.8 · CVSS v4 8.5

CVE-2026-94593

Armatura One's backup routine logs full database connection strings, including superuser passwords, in plain text. This exposes credentials

Overview

Armatura One's backup routine logs full database connection strings, including superuser passwords, in plain text. This exposes credentials to anyone with OS access, enabling unauthorized database access. The flaw can compromise data confidentiality and integrity.

Description

Armatura One's backup and restore routine records the full database connection command, including the superuser password, in plain text in a log file on the host. Credentials disclosed by this finding can be used to access the database when access to the server operating system is available.

Impact

Confidentiality: attackers can obtain superuser credentials, allowing full database access. Integrity: unauthorized changes or deletions can be performed. Availability is not directly affected. Defenders include database administrators and system operators who must secure logs and restrict OS access.

Remediation

Apply the vendor patch that removes passwords from log files. Configure logging to exclude connection strings or use secure logging mechanisms. Restrict OS-level access to the host and rotate logs regularly. Use role-based database access and store credentials in a vault rather than in scripts.

Risk context

Severity is high with CVSS v3 score 7.8 and CVSS v4 score 8.5. No EPSS data is available. The risk is significant for deployments that expose logs to privileged users.

Affected products

  • Armatura One Backup
  • Armatura One

Scores

Severity
high
CVSS v2
6.8
CVSS v3
7.8
CVSS v4
8.5
EPSS
—

credential-leak logging database ArmaturaOne high-severity confidentiality defense

← All CVEs

Related CVEs

high

CVE-2026-104912

MISP before v2.5.48 has an authorization flaw in correlation handling during attribute searches. Correlated attributes and events can be authorized using a stale distribution snapshot instead of the live event access control list. This matters because restricted or unpublished events may remain visible to authenticated users who no longer have permission.

View analysis

high

CVE-2026-94544

CVE-2026-94544 exposes a cache sharing flaw in Next.js 16.3.0‑16.3.8 that allows unauthenticated users to see unpublished draft content or see published content in draft mode. The vulnerability arises when Cache Components or experimental.useCache are enabled and cached functions return draft‑dependent data. It can lead to accidental disclosure of sensitive content on public sites.

View analysis

high

CVE-2026-94591

Armatura One stores database and message‑broker credentials in an install configuration file encrypted with AES‑128‑CBC. The encryption key and IV are hard‑coded and identical across all installations, allowing an attacker who obtains the installation package to decrypt any configuration file. This flaw can expose critical credentials used to access the database and broker.

View analysis

high

CVE-2026-94592

Armatura One's database initialization uses a fixed vendor password for the superuser, allowing anyone with OS access to log in as the database administrator. This flaw can lead to full database compromise on installations where the default password remains unchanged. It is critical for deployments to change the superuser password immediately.

View analysis