CVE-2026-108088

Deferred Deferred - Pending Action

Cache Information Exposure in Apache Cocoon

Publication date: 2026-10-20

Last updated on: 2026-10-29

Assigner: Apache Software Foundation

Description

** UNSUPPORTED WHEN ASSIGNED ** Use of cache containing sensitive information vulnerability in Apache Cocoon. When using the cache on a multi-user application, cached values for one user could be used when serving content for other users. This issue affects Apache Cocoon: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-29

Generated

2026-11-09

AI Q&A

2026-10-20

EPSS Evaluated

2026-11-08

NVD

CVE-2026-108088

EUVD

EUVD-2026-104913

Affected Vendors & Products

Vendor	Product	Version / Range
Apache Software Foundation	Apache Cocoon	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-524	The code uses a cache that contains sensitive information, but the cache can be read by an actor outside of the intended control sphere.

Attack-Flow Graph

Executive Summary

This vulnerability involves a cache in Apache Cocoon that stores sensitive information. In multi-user applications, cached data for one user might be incorrectly used when serving content to another user, potentially exposing sensitive data across users.

Detection Guidance

Since Apache Cocoon is no longer supported and this vulnerability affects all versions, detection is challenging. The issue involves cached sensitive data being exposed to unauthorized users. Check if your system runs Apache Cocoon by inspecting server configurations or logs for Cocoon-related paths or endpoints. If detected, restrict access to trusted users only as recommended.

Impact Analysis

If you use Apache Cocoon in a multi-user environment, this flaw could allow unauthorized access to another user's cached sensitive data, leading to privacy breaches or data leaks.

Compliance Impact

This vulnerability could violate data protection regulations like GDPR or HIPAA by exposing sensitive user data to unauthorized individuals, potentially resulting in legal penalties or compliance violations.

Mitigation Strategies

Since Apache Cocoon is retired and no longer supported, the recommended mitigation is to stop using it entirely. If continued use is unavoidable, restrict access to the instance to only trusted users to prevent unauthorized access to cached sensitive information.

Hi! I’m here to help you understand CVE-2026-108088. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...