Is CVE-2026-55221 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-55221 being exploited in the wild.

How severe is CVE-2026-55221?

Medium severity, with a CVSS score of 6.5, published 2 September 2026.

Which products and versions are affected?

Malach-It Boruta before 0.10.0.

Is there a fix for CVE-2026-55221?

A patch was published on 0.10.0: released 2026-06-12 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-55221 attacked?

It is attacked with local access, in a hosted service.

Am I affected by CVE-2026-55221?

Check whether you run Malach-It Boruta at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55221: Boruta authorization server sensitive token logging

CVE-2026-55221 · Severity: medium · CVSS 6.5 · Published 2026-09-02

Boruta is an OAuth 2.0 and OpenID Connect authorization server used for managing user authentication and delegated access. Prior to version 0.10.0, the system logged sensitive security tokens (access tokens, refresh tokens, authorization codes, ID tokens, and others) in business event logs, exposing them to anyone with access to logs or log aggregation systems. An attacker could recover these tokens and impersonate users or applications until the tokens expired or were revoked.

Technologies: Malach-It Boruta. Vendors: Malach-It.

Quick answers

Is CVE-2026-55221 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-55221 being exploited in the wild.
How severe is CVE-2026-55221?: Medium severity, with a CVSS score of 6.5, published 2 September 2026.
Which products and versions are affected?: Malach-It Boruta before 0.10.0.
Is there a fix for CVE-2026-55221?: A patch was published on 0.10.0: released 2026-06-12 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55221 attacked?: It is attacked with local access, in a hosted service.
Am I affected by CVE-2026-55221?: Check whether you run Malach-It Boruta at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a sensitive information disclosure bug in the logging layer of Boruta's OAuth and OpenID Connect implementation. The vulnerable component logged business events containing plaintext OAuth credentials including access tokens, refresh tokens, authorization codes, agent tokens, direct-post codes, ID tokens, and VP tokens submitted to introspection or revocation endpoints. Attack preconditions include having access to Boruta instance logs, centralized log aggregation systems, or the administration log viewer interface. An attacker with log access can extract these credentials and use them for token-based authentication until expiration or revocation. The vulnerability was patched in version 0.10.0 by redacting OAuth credentials from logged events; a security commit on 2026-05-30 demonstrates credential redaction in the logging implementation.

Affected products

malach-it Boruta before 0.10.0

Timeline

2026-09-02: disclosed
0.10.0: patched: released 2026-06-12

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.