Information disclosure in the Jager project jaegertracing/jaeger
Priority LOW 32CWE-200Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Partial Red Hat: 1 fixed, 1 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-200.
Summary
Sensitive information written to a log file vulnerability was found in jaegertracing/jaeger before version 1.18.1 when the Kafka data store is used. This flaw allows an attacker with access to the container's log file to discover the Kafka credentials.
Why it matters now
EPSS 0.00431 37th percentileScored 2026-11-07
Fix Partial github.com/jaegertracing/jaeger (Go): 1.18.1Red Hat: 1 advisoryRed Hat: 1 fixed, 1 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| the Jager project | jaegertracing/jaeger | 1.18.1 | — | No fix listed | CNA |
| — | github.com/jaegertracing/jaeger (Go) | before 1.18.1 | 1.18.1 | Patch available | GHSA-gh32-pc56-4c96 |
- jaegertracing/jaeger Vendorthe Jager project Affected 1.18.1 Fixed in — No fix listed CNA
- github.com/jaegertracing/jaeger (Go) Vendor— Affected before 1.18.1 Fixed in 1.18.1 Patch available GHSA-gh32-pc56-4c96
Remediation
- Fix · GHSA-gh32-pc56-4c96 github.com/jaegertracing/jaeger (Go) Fixed in 1.18.1 Advisory →
Red Hat 1 advisory
- RHSA-2020:2636 Released 2020-06-19 · Red Hat rating ModerateRed Hat OpenShift Jaeger 1.17.3 container images security update
- Red Hat OpenShift Jaeger 1.17 distributed-tracing/jaeger-all-in-one-rhel7, distributed-tracing/jaeger-collector-rhel7, distributed-tracing/jaeger-ingester-rhel7
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| OpenShift Service Mesh 1 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Jaeger 1.17 | Fixed | RHSA-2020:2636 |
Timeline
- 2026-10-02 Threatist record created from CVE-2020-10750
- 2026-10-03 Alias added: GHSA-gh32-pc56-4c96
References
Advisory 2
Sources
- CVE-2020-10750 · CVE Program
- CVE-2020-10750 · NVD
- FIRST EPSS
- GHSA-gh32-pc56-4c96 · GitHub Advisory Database · CC BY 4.0
- CVE-2020-10750 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences