CVE-2026-87779: Apache Syncope: AES Secret Key disclosure via log output
Insertion of sensitive information into log file vulnerability in Apache Syncope.
When AES key of non-standard length (not 16/24/32 bytes) is configured, Syncope will pad the provided value with random characters. The resulting key value is logged.
This issue affects Apache Syncope: from 3.0.15 through 3.0.16, from 4.0.3 through 4.0.7, from 4.1.0-M0 through 4.1.2.
Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Syncopeto a version that resolves this vulnerability.Fixed in 4.0.8 - Upgrade
Upgrade
Apache Syncopeto a version that resolves this vulnerability.Fixed in 4.1.3
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments are affected if they run Apache Syncope 3.0.15 through 3.0.16, 4.0.3 through 4.0.7, or 4.1.0-M0 through 4.1.2 and have an AES key configured with a length other than 16, 24, or 32 bytes.
What condition causes the key material to be written to logs?
The issue is triggered when Syncope receives a non-standard-length AES key. Syncope pads that value with random characters, and the resulting key value is logged.
What versions address the problem?
Upgrade to Apache Syncope 4.0.8 or 4.1.3, which fix the issue.