CVE-2026-94594

MEDIUM 4.0

Armatura LLC Armatura One Insertion of Sensitive Information into Log File

CVSS Score

4.0

EPSS Score

0.0%

EPSS Percentile

0th

Armatura One's message broker logs client connection credentials and the associated password in plain text during normal operation. Any party with read access to this log, or to a backup or support bundle that includes it, can obtain the logged credential.

CWE	CWE-532
Vendor	armatura llc
Product	armatura one
Published	Oct 2, 2026

Stay Ahead of the Next One

Get instant alerts for armatura llc armatura one

Be the first to know when new medium vulnerabilities affecting armatura llc armatura one are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Affected Versions

Armatura LLC / Armatura One

0 < 4.7.2

Armatura LLC / Armatura One (USA)

0 < 4.6.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

cisa.gov: https://www.cisa.gov/news-events/ics-advisories/icsa-26-274-01 github.com: https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-274-01.json

Credits

Andrew Capobianco of RewCon.co reported this vulnerability to CISA.