CVE-2026-50205: Plaintext Log Credential Leakage
System log files output unencrypted SMTP server authentication passwords alongside sensitive employee corporate identification data.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable logging of SMTP server authentication passwords in plaintext. Update logging configuration/code to stop writing auth credentials to logs.
system/application logging log_smtp_auth_passwords = disabled - Configuration
Enable redaction or pseudonymization for employee corporate identification data (PII) and other sensitive fields so that identifiers are not recorded in logs in plaintext.
logging pipeline / log redaction pii_redaction = enabled - Compensating control
Restrict access to log files and logging endpoints to authorized personnel only (apply strict file-system permissions and RBAC) and limit network access to log collection/management interfaces via firewall/ACLs.
- Operational
Rotate any SMTP server authentication passwords that were written to logs and invalidate the exposed credentials. Securely delete or purge affected log files and any backups that contain the exposed credentials.
- Operational
Audit logs and systems to determine the scope of the credential and PII exposure, search for occurrences of plaintext passwords and sensitive IDs, and follow incident response procedures (including notifying affected parties as required).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-50205?
CVE-2026-50205 has a high severity rating of 8.8 based on the CVSS scoring system.
How do I fix CVE-2026-50205?
To fix CVE-2026-50205, update to the latest version of Acer Connect M6e 5g Firmware that addresses the plaintext log credential leakage issue.
What kind of data is affected by CVE-2026-50205?
CVE-2026-50205 affects unencrypted SMTP server authentication passwords and sensitive employee corporate identification data in log files.
What are the potential risks associated with CVE-2026-50205?
The risks associated with CVE-2026-50205 include the potential for unauthorized access to sensitive information and compromise of employee credentials.
When was CVE-2026-50205 published?
CVE-2026-50205 was published on June 4, 2026.