Is CVE-2026-40945 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-40945 being exploited in the wild.

How severe is CVE-2026-40945?

High severity, with a CVSS score of 4, published 14 April 2026.

Which products and versions are affected?

github.com/oxia-db/oxia (Go) <= 0.16.1, SEMVER:introduced=0,fixed=0.16.2.

Is there a fix for CVE-2026-40945?

Yes. github.com/oxia-db/oxia (Go): upgrade to 0.16.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Am I affected by CVE-2026-40945?

Check whether you run github.com/oxia-db/oxia (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-40945: Oxia exposes bearer token in debug log messages on authentication failure

Q: Is there a fix for CVE-2026-40945?

Yes. github.com/oxia-db/oxia (Go): upgrade to 0.16.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: Am I affected by CVE-2026-40945?

Check whether you run github.com/oxia-db/oxia (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-40945 · Severity: high · CVSS 4 · Published 2026-04-14

### Summary When OIDC authentication fails, the full bearer token is logged at DEBUG level in plaintext. If debug logging is enabled in production, JWT tokens are exposed in application logs and any connected log aggregation system.

### Impact An attacker with access to application logs (e.g., via a compromised log aggregation pipeline, shared logging infrastructure, or misconfigured log access controls) can extract valid JWT tokens and replay them to authenticate as legitimate users.

All versions using OIDC authentication are affected.

### Details In `oxiad/common/rpc/auth/interceptor.go`, the `validateTokenWithContext()` function logs the complete token value via `slog.String("token", token)` when authentication fails. This includes the full JWT header, payload, and signature.

### Patches Fixed by redacting the token in log output — only the last 8 characters are preserved for correlation purposes.

### Workarounds Ensure DEBUG-level logging is never enabled in production environments.

Technologies: github.com/oxia-db/oxia (Go). Vendors: Go.

Quick answers

Is CVE-2026-40945 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-40945 being exploited in the wild.
How severe is CVE-2026-40945?: High severity, with a CVSS score of 4, published 14 April 2026.
Which products and versions are affected?: github.com/oxia-db/oxia (Go) <= 0.16.1, SEMVER:introduced=0,fixed=0.16.2.
Is there a fix for CVE-2026-40945?: Yes. github.com/oxia-db/oxia (Go): upgrade to 0.16.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
Am I affected by CVE-2026-40945?: Check whether you run github.com/oxia-db/oxia (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/oxia-db/oxia (Go): upgrade to 0.16.2 or later
```
go get github.com/oxia-db/oxia@v0.16.2
```

Affected products

github.com/oxia-db/oxia (Go) <= 0.16.1, SEMVER:introduced=0,fixed=0.16.2

Identifiers

CVE-2026-40945
GHSA-pm7q-rjjx-979p
GO-2026-5546

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.