Operator: plaintext password in operator log

published 2023-09-26 3 y ago modified 2026-06-17 4 mo ago also EUVD-2023-53955

cvss: 5.5; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 16%
public exploits: 0; none known

A flaw was found in Red Hat AMQ Broker Operator, where it displayed a password defined in ActiveMQArtemisAddress CR, shown in plain text in the Operator Log. This flaw allows an authenticated local attacker to access information outside of their permissions.

Patch / fix

fixed in 1

Red Hat RHEL-8 based Middleware Containers 7.11.1-9, 7.11.1-12

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-4065 updated 2026-03-18 cvss 5.5

Operator: plaintext password in operator log

Red Hat AMQ Broker 7 amq-7/amq-broker-operator-container
affected: no fix available
Red Hat Middleware Containers for OpenShift amq7/amq-broker-rhel8-operator 7.11.1-9, amq7/amq-broker-rhel8-operator-bundle 7.11.1-12
fixed: vendor fix RHSA-2023:4720

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 2 y ago (2024-04-26)

Exploit prediction

0.25% chance of exploitation in the next 30 days, higher than 16% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	5.5	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
NVD	3.1	5.5	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected products

Red Hat RHEL-8 based Middleware Containers
Red Hat Red Hat AMQ Broker 7

Classification

Weakness

CWE-117 Improper Output Neutralization for Logs
CWE-276 Incorrect Default Permissions

References

access.redhat.com /errata/RHSA-2023:4720
vendor-advisory
access.redhat.com /security/cve/CVE-2023-4065
vdb-entry, vendor-advisory
bugzilla.redhat.com /show_bug.cgi?id=2224630
issue-tracking, vendor-advisory

Sources

CVE List CVE-2023-4065
NVD CVE-2023-4065

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary