CVE-2026-43826

The OpenSearch logging provider, when configured with a host URL that embeds credentials for example https://user:[email protected]:9200, wrote the full host URL — including the embedded credentials — into task logs. Any user with task-log read permission could harvest the backend...

CVE-2026-43826

creationtimestamp| type| source ---|---|--- 2026-05-10 20:21:12+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mljljjypls2s 2026-05-11 10:57:01+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mll4hefmlq2r...