CVE-2026-103371: Apache Geode: Management REST API: Insertion of Sensitive Information into Log File
Moderate-severity Apache Geode Management REST API flaw logs sensitive information, with no exploitation reported.
28
CVE-2026-103371
Sensitive Data Logged by Apache Geode Web Management
- CVSS 3.1
- 7.5 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Apache Geode’s web management component can write sensitive information into log files through its Management REST API. The flaw affects Apache Geode from version 2.0.0 before 2.0.3. Anyone who can read those logs—including operators, log aggregators, or an attacker with log access—may obtain information that should not have been recorded. Apache recommends upgrading to 2.0.3, which fixes the issue. No public proof of concept is known and the vulnerability is not listed in CISA KEV.
What to do: Upgrade Apache Geode to 2.0.3. Restrict access to web-management and application logs, review logs produced by the Management REST API for sensitive data, and rotate any secrets that may have been recorded.
| Product | Affected |
|---|---|
| Apache Geode | 2.0.0 before 2.0.3 |
Estimated exposure
nicheNo basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Insertion of Sensitive Information into Log File in Apache Geode Web Management. This issue affects Apache Geode: from 2.0.0 before 2.0.3. Users are recommended to upgrade to version 2.0.3, which fixes the issue.
- Weakness
- CWE-532
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N