ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-105963

Secret key base exposed in stack trace arguments on wrong-typed Plug.Crypto arguments

Published Oct 23, 2026 · catalog updated Oct 23, 2026 · Secret key base exposed

Last checked Nov 6, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-105963. EPSS is 0.51%. Act only if a listed version of Secret key base exposed is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (Secret key base exposed).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
Unknown—
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.51%
Remediation
Advisory link
Affected products
Hex plug · Hex plug_crypto

## Summary Externally-Generated Error Message Containing Sensitive Information vulnerability in in elixir-plug plug_crypto allows an unauthenticated remote attacker to expose the secret key base through application logs via a wrong-typed argument. Every public function in validates argument types in a function-head guard. A failed guard makes the Erlang VM raise with the actual argument values in the top stack frame, so the secret key base, a derived key, or the value an API key is compared against lands in that frame. The library's blocks and only reach exceptions raised inside a function body, so they never see a guard failure. Plug.Cowboy and Bandit write the frame to the error log and attach it as Logger metadata, which error trackers forward. Two entry points take request data. exposes the secret key base when the token is neither a binary nor nil, which reaches because it forwards the token unguarded. exposes the other operand when one side is not a binary, as happens when a missing request header yields nil. Reading the leaked value needs separate access to the logs or the error tracker, so the request alone does not disclose the secret to the attacker. This issue affects plug: from 1.6.3 before 1.7.0; plug_crypto: from 1.0.0 before 2.2.1. ## Details **1. Type checks in function-head guards.** Every public function in validates its arguments in a head guard, for example with and with . **2. The VM builds the error, not the library.** When no clause matches, the Erlang VM raises and the top stack frame holds the actual argument values. The library's blocks and only apply to exceptions raised inside a function body, so a guard failure never reaches them. In the same commit that added also added these guards. **3. Which value leaks.** and put the secret key base in the frame. has no guard on its main clause, so the key is derived first and the failing guard belongs to , placing the derived 32-byte key in the frame. places the other operand in the frame, which is

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • Hex plug1.6.3 → 1.7.0
  • Hex plug_crypto1.0.0 → 2.2.1

How to fix CVE-2026-105963

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-105963. EPSS is 0.51%. Act only if a listed version of Secret key base exposed is installed.

Which versions are affected?

Compare what you have installed with 1.6.3 → 1.7.0, 1.0.0 → 2.2.1. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-532: Insertion of Sensitive Information into Log File. EPSS 0.51%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 23, 2026 · GitHub Advisory Database

    Detected

    ## Summary Externally-Generated Error Message Containing Sensitive Information vulnerability in in elixir-plug plug_crypto allows an unauthenticated remote attacker to expose the secret key base through application logs via a wrong-typed argument. Every public function in validates argument types in a function-head guard. A failed guard makes the Erlang VM raise with the actual argument values in

  2. Oct 23, 2026 · GitHub Advisory Database

    Fix available

    plug fixed in 1.7.0; plug_crypto fixed in 2.2.1

  3. Oct 23, 2026 · GitHub Advisory Database

    Fix available

    plug fixed in 1.7.0

  4. Oct 23, 2026 · GitHub Advisory Database

    Fix available

    plug_crypto fixed in 2.2.1

  5. Oct 23, 2026 · GitHub Advisory Database

    Updated

    ## Summary Externally-Generated Error Message Containing Sensitive Information vulnerability in in elixir-plug plug_crypto allows an unauthenticated remote attacker to expose the secret key base through application logs via a wrong-typed argument. Every public function in validates argument types in a function-head guard. A failed guard makes the Erlang VM raise with the actual argument values in

Sources

References

Freshness

Last verified in this catalog Nov 6, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

  • FIRST EPSSNov 6, 2026
  • GitHub Advisory DatabaseOct 26, 2026
  • OpenSSF OSV / OSV ScannerOct 26, 2026
  • CVE.orgOct 23, 2026