All vulnerabilities
CVE-2026-94594

Armatura LLC Armatura One Insertion of Sensitive Information into Log File

Armatura LLC Armatura One
Open in ThreatlineRecord JSON
CVSS
4.0Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.11%Chance of exploitation activity in the next 30 days, higher than 1% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in4.7.2Also 4.6.1CVE List
Published2 Oct 2026Updated 3 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Armatura One's message broker logs client connection credentials and the associated password in plain text during normal operation. Any party with read access to this log, or to a backup or support bundle that includes it, can obtain the logged credential.

Text from CVE List

Affected versions 4

  • Armatura Oneaffected: all versions before 4.7.2CVE List
  • Armatura Oneunaffected: 4.7.2CVE List
  • Armatura One (USA)affected: all versions before 4.6.1CVE List
  • Armatura One (USA)unaffected: 4.6.1_USACVE List

References 2