CVE-2026-94593 PUBLISHED

Armatura LLC Armatura One Insertion of Sensitive Information into Log File

Assigner: icscert
Reserved: 21.09.2026 Published: 02.10.2026 Updated: 02.10.2026

Armatura One's backup and restore routine records the full database connection command, including the superuser password, in plain text in a log file on the host. Credentials disclosed by this finding can be used to access the database when access to the server operating system is available.

Metrics

CVSS Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS Score: 8.5

Product Status

Vendor Armatura LLC
Product Armatura One
Versions Default: unaffected
  • affected from 0 to 4.7.2 (excl.)
  • Version 4.7.2 is unaffected
Vendor Armatura LLC
Product Armatura One (USA)
Versions Default: unaffected
  • affected from 0 to 4.6.1 (excl.)
  • Version 4.6.1_USA is unaffected

Solutions

Armatura LLC has released Armatura One V4.7.2, which resolves this issue. Users should upgrade from V4.7.1 or earlier to V4.7.2.

Armatura LLC has released Armatura One V4.6.1_USA, which resolves this issue. Users of the USA release line should upgrade from V4.3.1_USA or earlier to V4.6.1_USA.

Armatura LLC recommends contacting official technical support for guidance on obtaining and applying the upgrade.

Credits

  • Andrew Capobianco of RewCon.co reported this vulnerability to CISA. finder

References

Problem Types

  • CWE-532 CWE