Logging Redactor: PII exposure in logs (CVE-2026-63417)
The loggingredactor library fails to redact PII within custom __str__ and __repr__ methods of non-primitive objects, resulting in the leakage of sensitive data into application logs.
CVE search metadata
CVE search record: CVE-2026-63417. EPSS: 0.30%. KEV: no. Product: loggingredactor (< 0.0.7). Brief: Logging Redactor: PII exposure in logs (CVE-2026-63417). Brief link: https://feed.craftedsignal.io/briefs/2026-11-logging-redactor-pii-leak/
Triage facts
Revision 1- Applicability
- loggingredactor (< 0.0.7)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 2 public sources
- Freshness
- Revision 1Nov 9, 22:15 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- B2Roughly even chance
Logging Redactor (loggingredactor) versions prior to 0.0.7 contain a vulnerability (CVE-2026-63417) where Personally Identifiable Information (PII) is not correctly redacted when processed by custom __str__ and __repr__ functions for non-primitive Python objects. This flaw causes sensitive information to be written to application log files in cleartext. There are no workarounds available for this vulnerability.
Impact
Successful exploitation or accidental trigger of this vulnerability leads to the leakage of PII into application logs. This increases the risk of unauthorized access to sensitive data if log files are stored in insecure locations, exposed through log management systems, or accessible to unauthorized personnel.
Recommendation
- Upgrade the
loggingredactorpackage to version 0.0.7 or later across all applications and environments. - Review existing application logs for potential historical PII exposure if the library was used to handle sensitive data.
- Rotate any credentials or secrets that may have been inadvertently logged while using affected versions of the library.
Immediate actions
Upgrade loggingredactor to version 0.0.7 or later
Threat Hunt
Identify applications using the loggingredactor library and scan log repositories for patterns matching sensitive PII formats
Data: Application log files, Dependency manifests (e.g., requirements.txt, pyproject.toml)
Mitigations
Upgrade loggingredactor to 0.0.7
CVE-2026-63417