Read the docs
TI-2026-65947 Aliases CVE-2026-94594GHSA-cmfx-346m-p68q

Armatura LLC Armatura One Insertion of Sensitive Information into Log File

Priority LOW 22CWE-532Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-532.

Summary

Armatura One's message broker logs client connection credentials and the associated password in plain text during normal operation. Any party with read access to this log, or to a backup or support bundle that includes it, can obtain the logged credential.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00115 1st percentileScored 2026-11-07
Fix Fixed Armatura One (Armatura LLC): 4.7.2Armatura One (USA) (Armatura LLC): 4.6.1, 4.6.1_USA

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Armatura LLCArmatura Onebefore 4.7.24.7.2Patch availableCNA
Armatura LLCArmatura One (USA)before 4.6.14.6.1, 4.6.1_USAPatch availableCNA
  • Armatura One VendorArmatura LLC Affected before 4.7.2 Fixed in 4.7.2 Patch available CNA
  • Armatura One (USA) VendorArmatura LLC Affected before 4.6.1 Fixed in 4.6.1, 4.6.1_USA Patch available CNA

Remediation

  • Fix · CNA Armatura One (Armatura LLC) Fixed in 4.7.2
  • Fix · CNA Armatura One (USA) (Armatura LLC) Fixed in 4.6.1, 4.6.1_USA

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Armatura One, Armatura One (USA) 4.6.1, 4.7.2

    4 records Highest priority Priority LOW 4 LOW

    Other records, highest priority first

    • TI-2026-65946 Armatura LLC Armatura One Insertion of Sensitive Information into Log FilePriority LOW 38
    • TI-2026-65945 Armatura LLC Armatura One Use of Hard-coded CredentialsPriority LOW 38
    • TI-2026-65944 Armatura LLC Armatura One Use of Hard-coded Cryptographic KeyPriority LOW 38
    Show all 4 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-94594
  2. 2026-10-03 Alias added: GHSA-cmfx-346m-p68q
  3. 2026-10-03 CISA SSVC decision points changed

References

Other 2

  • TI-2026-65946 Armatura LLC Armatura One Insertion of Sensitive Information into Log File CVSS 4.0HIGH 8.5
  • TI-2026-65945 Armatura LLC Armatura One Use of Hard-coded Credentials CVSS 4.0HIGH 8.6
  • TI-2026-65944 Armatura LLC Armatura One Use of Hard-coded Cryptographic Key CVSS 4.0HIGH 8.6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences