CVE-2026-105963 elixir-plug CVE debrief

Who should care

Defenders of Elixir applications using the plug_crypto library should be aware of this vulnerability and take steps to verify and update their dependencies. They should also review their application logs for any potential exposure of sensitive information.

Why it matters

CVE-2026-105963 is a vulnerability in the plug_crypto library for Elixir that allows an unauthenticated remote attacker to expose the secret key base through application logs. Defenders should prioritize verifying and updating their dependencies, reviewing application logs, and implementing additional logging security measures.

• Defenders need to verify the versions of plug and plug_crypto in their Elixir applications.
• Defenders need to review application logs for potential exposure of sensitive information.
• Defenders need to implement additional logging security measures to prevent sensitive information from being written to logs.
• Defenders need to update to the latest patched versions of plug and plug_crypto.

Technical summary

The vulnerability occurs when a wrong-typed argument is passed to certain functions in Plug.Crypto, causing a FunctionClauseError with the actual argument values in the top stack frame. This can lead to the secret key base being written to the error log. The vulnerability affects multiple packages, including plug and plug_crypto. Defenders should prioritize verifying the versions of plug and plug_crypto in their Elixir applications and updating to the latest patched versions. They should also review their application logs for any potential exposure of sensitive information and implement additional logging security measures.

Defensive priority

Defenders should prioritize verifying the versions of plug and plug_crypto in their Elixir applications and updating to the latest patched versions. They should also review their application logs for any potential exposure of sensitive information.

Recommended defensive actions

• Verify the versions of plug and plug_crypto in your Elixir applications and update to the latest patched versions.
• Review application logs for potential exposure of sensitive information.
• Implement additional logging security measures to prevent sensitive information from being written to logs.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability is caused by a lack of input validation in the Plug.Crypto library, which allows an attacker to trigger a FunctionClauseError with sensitive information in the stack trace. The error is then written to the application logs, potentially exposing the secret key base.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.