What’s Vulnerable › Vulnerabilities

CVE-2024-0006: DB User Password Leak in Application Log

• Severity: medium (CVSS 5.4 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-07-19 · updated 2026-06-17
• Weakness: CWE-532

Description

Information exposure in the logging system in Yugabyte Platform allows local attackers with access to application logs to obtain database user credentials in log files, potentially leading to unauthorized database access.

Affected products

• YugabyteDB: from 2.18.0.0 before 2.18.9.0; from 2.20.0.0 before 2.20.2.3; from 2024.0.0.0 before 2024.1.1.0 — fixed in 2.18.9.0, 2.20.2.3, 2024.1.1.0

How to fix

Upgrade to a fixed version: YugabyteDB 2.18.9.0, 2.20.2.3, 2024.1.1.0. Check the vendor advisory for mitigations.

References

• https://github.com/yugabyte/yugabyte-db/commit/439c6286f1971f9ac6bff2c7215b454c2025c593
• https://github.com/yugabyte/yugabyte-db/commit/5cc7f4e15d6ccccbf97c57946fd0aa630f88c9e2
• https://github.com/yugabyte/yugabyte-db/commit/d96e6b629f34d065b47204daeeb44064e484c579
• https://github.com/yugabyte/yugabyte-db/commit/439c6286f1971f9ac6bff2c7215b454c2025c593
• https://github.com/yugabyte/yugabyte-db/commit/5cc7f4e15d6ccccbf97c57946fd0aa630f88c9e2
• https://github.com/yugabyte/yugabyte-db/commit/d96e6b629f34d065b47204daeeb44064e484c579

Get alerted when CVE-2024-0006 or the next vulnerability affects your stack