CVE-2026-94594 PUBLISHED

Armatura LLC Armatura One Insertion of Sensitive Information into Log File

Assigner: icscert
Reserved: 21.09.2026 Published: 02.10.2026 Updated: 02.10.2026

Armatura One's message broker logs client connection credentials and the associated password in plain text during normal operation. Any party with read access to this log, or to a backup or support bundle that includes it, can obtain the logged credential.

Metrics

CVSS Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS Score: 5.1

Product Status

Vendor Armatura LLC
Product Armatura One
Versions Default: unaffected
  • affected from 0 to 4.7.2 (excl.)
  • Version 4.7.2 is unaffected
Vendor Armatura LLC
Product Armatura One (USA)
Versions Default: unaffected
  • affected from 0 to 4.6.1 (excl.)
  • Version 4.6.1_USA is unaffected

Solutions

Armatura LLC has released Armatura One V4.7.2, which resolves this issue. Users should upgrade from V4.7.1 or earlier to V4.7.2.

Armatura LLC has released Armatura One V4.6.1_USA, which resolves this issue. Users of the USA release line should upgrade from V4.3.1_USA or earlier to V4.6.1_USA.

Armatura LLC recommends contacting official technical support for guidance on obtaining and applying the upgrade.

Credits

  • Andrew Capobianco of RewCon.co reported this vulnerability to CISA. finder

References

Problem Types

  • CWE-532 CWE