CVE-2026-40945 Oxia: Bearer token exposed in debug log messages on authentication failure
Attackers can steal JWT tokens from debug logs if enabled, allowing unauthorized access to the Oxia metadata store.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-40945?
CVE-2026-40945 is a high-severity vulnerability in oxia-db oxia, published on 21 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Oxia is a metadata store and coordination system. Prior to 0.16.2, when OIDC authentication fails, the full bearer token is logged at DEBUG level in plaintext. If debug logging is enabled in production, JWT tokens are exposed in application logs and any connected log aggregation system. This vulnerability is fixed in 0.16.2.
Weakness: CWE-532
Which versions are affected by CVE-2026-40945?
3 open source packages ship an affected version, including github.com/oxia-db/oxia.
| Package | Affected | Fixed in |
|---|---|---|
github.com/oxia-db/oxia Go | All versions | 0.16.2 |
github.com/oxia-db/oxia Go | All versions | 0.16.2 |
github.com/oxia-db/oxia Go | All versions | 0.16.2 |
How do I fix CVE-2026-40945?
Upgrade github.com/oxia-db/oxia to 0.16.2 or later.
Is CVE-2026-40945 being exploited?
There is no known exploitation of CVE-2026-40945 in the wild and no public exploit code.
Sources
Also known as GHSA-pm7q-rjjx-979p, GO-2026-5546.