CVE-2026-105707: uptrace user_handler.go Login information exposure
A security vulnerability has been detected in uptrace up to 2.1.0-beta.8. Affected by this vulnerability is the function Login of the file pkg/org/userhandler.go. The manipulation leads to information exposure through error message. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
The attack can be initiated remotely and requires no privileges or user interaction. Systems exposing the affected Login functionality are the relevant attack surface.
What versions are known to be affected?
Uptrace versions up to and including 2.1.0-beta.8 are reported as affected. The provided information does not identify a fixed version.
What is exposed if the issue is exploited?
The issue causes information exposure through error messages generated by the Login function in pkg/org/user_handler.go. The available data does not specify which information may be disclosed.
How urgent is remediation?
The vulnerability is rated medium severity with a 5.3 CVSS score, but public exploit disclosure is reported. Prioritize review of externally reachable Uptrace Login endpoints and error-message handling.