CVE-2026-41018

The Elasticsearch logging provider is vulnerable to credential leakage when configured with a host URL containing embedded credentials (e.g., https://user:[email protected]:9200). The provider writes the full URL, including secrets, into task logs , allowing any user with task-log read ...