CVE-2026-103371
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
Apache Geode Web Management versions from 2.0.0 before 2.0.3 contain a vulnerability that inserts sensitive information into log files. Upgrade to version 2.0.3 is recommended.
Risk Assessment
The vulnerability may lead to exposure of sensitive data in logs, potentially causing information leakage.
Recommendation
It is recommended to upgrade Apache Geode to version 2.0.3 or later, which fixes the issue.
Other vulnerabilities in Apache Geode
See all- CVE-2017-5649High
Apache Geode before version 1.1.1, when security is enabled, allows remote authenticated users with CLUSTER:READ but not DATA:READ permission to access the data browser page in Pulse, consequently executing an OQL query that exposes data stored in the cluster.
- CVE-2025-47410High
Apache Geode is vulnerable to CSRF attacks through GET requests to the Management and Monitoring REST API that could allow an attacker who has tricked a user into giving up their Geode session credentials to submit malicious commands on the target system on behalf of the authenticated user. This issue affects Apache Geode: versions 1.10 through 1.15.1.
Original NVD description (English source)
Insertion of Sensitive Information into Log File in Apache Geode Web Management. This issue affects Apache Geode: from 2.0.0 before 2.0.3. Users are recommended to upgrade to version 2.0.3, which fixes the issue.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS