CVE-2026-22041: loggingredactor converts non-string types to string types in logs

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-01-08 · updated 2026-06-17
Weakness: CWE-704

Description

Logging Redactor is a Python library designed to redact sensitive data in logs based on regex patterns and / or dictionary keys. Prior to version 0.0.6, non-string types are converted into string types, leading to type errors in %d conversions. The problem has been patched in version 0.0.6. No known workarounds are available.

Affected products

armurox loggingredactor: before 0.0.6 — fixed in 0.0.6

How to fix

Upgrade to a fixed version: armurox loggingredactor 0.0.6. Check the vendor advisory for mitigations.

References

https://github.com/armurox/loggingredactor/issues/7
https://github.com/armurox/loggingredactor/releases/tag/0.0.6
https://github.com/armurox/loggingredactor/security/advisories/GHSA-rvjx-cfjh-5mc9
https://github.com/armurox/loggingredactor/issues/7

Get alerted when CVE-2026-22041 or the next vulnerability affects your stack