CVE-2026-87779— Apache Syncope: AES Secret Key disclosure via log output
Quick assessment
Affected
Apache Software Foundation Apache Syncope
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Apache Syncope 存在日志文件中插入敏感信息漏洞。 当配置了非标准长度的 AES 密钥（即长度不是 16、24 或 32 字节）时，Syncope 会使用随机字符对提供的密钥值进行填充。填充后的密钥值会被记录到日志文件中，从而造成敏感信息泄露。 受此问题影响的版本：Apache Syncope 3.0.15 至 3.0.16，4.0.3 至 4.0.7，以及 4.1.0-M0 至 4.1.2。 建议用户升级至 4.0.8 或 4.1.3 版本，这些版本已修复该问题。
Possible ATT&CK Techniques 2 AI
T1190 · Exploit Public-Facing Application T1041 · Exfiltration Over C2 Channel
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-87779
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache Syncope: AES Secret Key disclosure via log output
Source: CVE Program / CVE List V5
Vulnerability Description
Insertion of sensitive information into log file vulnerability in Apache Syncope.
When AES key of non-standard length (not 16/24/32 bytes) is configured, Syncope will pad the provided value with random characters. The resulting key value is logged.
This issue affects Apache Syncope: from 3.0.15 through 3.0.16, from 4.0.3 through 4.0.7, from 4.1.0-M0 through 4.1.2.
Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
通过日志文件的信息暴露
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache Syncope | 3.0.15 ~ 3.0.16 | - |
|
II. Public POCs for CVE-2026-87779
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-87779
请登录查看更多情报信息。
Mailing List Discussions for CVE-2026-87779 (1)
Same Patch Batch · Apache Software Foundation · 2026-09-14 · 20 CVEs total
| CVE-2026-77883 | Apache Syncope: Information disclosure via one-hop JEXL navigation past the JexlContextBui | |
| CVE-2026-72524 | Apache Doris: Authorization bypass allowing a low-privilege user to read/write/drop arbitr | |
| CVE-2026-68570 | Apache Doris: Authorization bypass leading to unauthorized data access | |
| CVE-2026-87802 | Apache Syncope: SRA OAuth2 JWT signature verification bypass | |
| CVE-2026-87785 | Apache Syncope: JWT subject spoofing | |
| CVE-2026-86460 | Apache Syncope: Cypher Injection via FIQL Search on Neo4j Persistence | |
| CVE-2026-82232 | Apache Syncope: SQL injection via sort parameter in Task search | |
| CVE-2026-78336 | Apache Syncope: OIDCC4UI provider list discloses client secrets to any authenticated user | |
| CVE-2026-78330 | Apache Syncope: Privilege escalation for admin user via JWT authentication | |
| CVE-2026-78318 | Apache Syncope: Unauthenticated reflected XSS in Console and Enduser | |
| CVE-2026-73178 | Apache Syncope: JWT Access Token takeover | |
| CVE-2026-77181 | Apache Syncope: ClientApp update entitlement not effective | |
| CVE-2026-77147 | Apache Syncope: Groovy Sandbox escape for empty CommandArgs | |
| CVE-2026-73668 | Apache Syncope: Cross-realm disclosure of confidential ConnId bundles configuration values | |
| CVE-2026-77051 | Apache Syncope: SQL injection via unsanitized entityKey and opEvent in Audit Events search | |
| CVE-2026-75030 | Apache Syncope: Incomplete authorization checks for Group members deprovisioning | |
| CVE-2026-75015 | Apache Syncope: Nested secrets leak cleartext into audit records readable | |
| CVE-2026-73579 | Apache Syncope: Non-recursive Any search could skip Realms restrictions | |
| CVE-2026-73470 | Apache Syncope: Delegating users can grant unowned Roles |
IV. Related Vulnerabilities
Same product: Apache Syncope
-
CVE-2026-73178
Apache Syncope: JWT Access Token takeover -
CVE-2026-73470
Apache Syncope: Delegating users can grant unowned Roles -
CVE-2026-73579
Apache Syncope: Non-recursive Any search could skip Realms r -
CVE-2026-75015
Apache Syncope: Nested secrets leak cleartext into audit rec -
CVE-2026-75030
Apache Syncope: Incomplete authorization checks for Group me
Same vendor: Apache Software Foundation
-
CVE-2026-73178
Apache Syncope: JWT Access Token takeover -
CVE-2026-73470
Apache Syncope: Delegating users can grant unowned Roles -
CVE-2026-73579
Apache Syncope: Non-recursive Any search could skip Realms r -
CVE-2026-75015
Apache Syncope: Nested secrets leak cleartext into audit rec -
CVE-2026-75030
Apache Syncope: Incomplete authorization checks for Group me
Same weakness: CWE-532
-
CVE-2026-87993
Consul-template vulnerable to an information disclosure issu -
CVE-2026-88883
Renovate before 44.14.4 TLS Private Key Log Sanitisation -
CVE-2026-79966
CWE-532: Insertion of Sensitive Information into Log File -
CVE-2026-80169
Dell Secure Connect Gateway 日志信息泄露漏洞 -
CVE-2025-46808
Sensitive information is leaked into NeuVector’s manager con
V. Comments for CVE-2026-87779
No comments yet