CVE-2026-105963
Description
A flaw was found in plug_crypto. An unauthenticated remote attacker can cause sensitive cryptographic secrets, such as the application's secret key base, to be exposed in application logs and crash reports. By submitting request data with unexpected argument types, an attacker triggers a validation error that includes internal cryptographic arguments in the error stack trace. Anyone with access to these application logs or error monitoring tools can view the leaked secrets, potentially compromising application security.
Statement
Red Hat rates this vulnerability as having a Moderate severity because obtaining the exposed cryptographic secrets requires secondary, privileged access to application logs or monitoring systems rather than direct disclosure via network responses. While an unauthenticated attacker can remotely force an unhandled type exception to write sensitive parameters into stack traces, the flaw does not directly leak data over the wire. Red Hat Enterprise Linux does not ship the affected Elixir Plug components in core enterprise offerings, limiting impact primarily to community and standalone deployments.
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Application Data
Often this will either reveal sensitive information which may be used to launch another, more focused attack or disclose private information stored in the server. For example, an attempt to exploit a path traversal weakness (CWE-22) might yield the full pathname of the installed application. In turn, this could be used to select the proper number of ".." sequences to navigate to the targeted file. An attack using SQL injection (CWE-89) might not initially succeed, but an error message could reveal the malformed query, which would expose query logic and possibly even passwords or other sensitive information used within the query.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
