Apache Cocoon diagnostic interfaces exposed without login (CVE-2026-108089)
Original title: CVE-2026-108089: Apache Cocoon: Unauthenticated access to diagnostic interfaces
Every Cocoon version lets an unauthenticated user trigger caches and read verbose debug and profile data.
Apache assigned moderate-severity CVE-2026-108089 to Apache Cocoon, marked unsupported when assigned. An unauthenticated user can reach diagnostic interfaces, including cache triggering, verbose debug logging, and profile information. The issue affects all versions. The posted description is cut off after noting the project's status.
Unconfirmed: The notice is truncated, so any planned fix or exploitation status is not shown.
- Posted by Arnout Engelen on October 20.
- Apache rates the issue moderate.
- Affected range is all Apache Cocoon versions.
- The flaw was unsupported when the CVE was assigned.
Impact: Unauthenticated access to diagnostics, debug logs, and profiles
| Product | Affected |
|---|---|
| Apache Cocoon | all versions |
- CVEs
- CVE-2026-108089
- Vendors
- Apache
- Products
- Apache Cocoon
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-108089 | Unauthenticated diagnostic info leak in Apache Cocoon (all versions) | 7.5 | — |
From the original article
Posted by Arnout Engelen on Oct 20 Severity: moderate Affected versions: - Apache Cocoon: all versions Description: ** UNSUPPORTED WHEN ASSIGNED ** Exposure of sensitive system information to an unauthorized control sphere vulnerability in Apache Cocoon. An unauthenticated user could gain access to diagnostic interfaces, including triggering of cache, exposure of (verbose) debug logging and profile information.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.