CVE-2026-108089 Apache Cocoon: Unauthenticated access to diagnostic interfaces
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-108089?
CVE-2026-108089 is a high-severity vulnerability in Apache Cocoon, published on 20 Oct 2026.
Official description
** UNSUPPORTED WHEN ASSIGNED ** Exposure of sensitive system information to an unauthorized control sphere vulnerability in Apache Cocoon. An unauthenticated user could gain access to diagnostic interfaces, including triggering of cache, exposure of (verbose) debug logging and profile information.
This issue affects Apache Cocoon: all versions.
As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.
NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Weakness: CWE-497
Which versions are affected by CVE-2026-108089?
How do I fix CVE-2026-108089?
No fix has been published for CVE-2026-108089 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-108089 being exploited?
There is no known exploitation of CVE-2026-108089 in the wild and no public exploit code.
Sources
Also known as GHSA-fv7w-gq56-762w.