CVE-2026-82371: Plaintext exposure of sensitive authentication data in SANnav discovery service log files
Plaintext exposure of sensitive authentication data in Brocade SANnav discovery service log files enables individuals with file read access to retrieve administrative switch credentials and active session tokens. An attacker with access to system logs or support bundles can leverage exposed authentication details to compromise managed network infrastructure and access active application sessions. This vulnerability affects Brocade SANnav versions before 3.0.1a.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Brocade SANnavto a version that resolves this vulnerability.Fixed in 3.0.1a
Event History
Frequently Asked Questions
Who is realistically able to exploit this issue?
Individuals who can read SANnav discovery service logs or obtain SANnav support bundles can retrieve exposed administrative switch credentials and active session tokens. This includes users or processes with file-read access to those artifacts.
What could an attacker do with the exposed data?
The exposed credentials may be used to compromise managed network infrastructure, while active session tokens may permit access to active application sessions.
Which deployments should be investigated?
Brocade SANnav deployments running versions before 3.0.1a should be investigated, particularly where discovery service logs or support bundles have been accessible to unauthorized parties.