A high-severity information disclosure vulnerability in the Aiven myhoard daemon allows authenticated users to access sensitive encryption keys via application logs.

This vulnerability is categorized as a resource leak (CWE-402). The daemon logs full backup information, including encryption keys, to system logs, which may be accessible to any authenticated user with read access to the log files.

The exposure of backup encryption keys presents a severe risk to data confidentiality, as unauthorized parties could potentially decrypt protected MySQL backups. With a CVSS score of 7.1, this vulnerability poses a significant risk to data integrity and long-term security, potentially leading to unauthorized access to sensitive corporate information stored within the database backups.

Immediate Action: Update the myhoard daemon to version 1.3.0 or later to eliminate the logging of sensitive keys.

Proactive Monitoring: Review existing application and system logs for the presence of encryption keys and rotate any keys that have been exposed in log files.

Compensating Controls: If an immediate update is not feasible, configure the daemon to redirect logs to /dev/null to prevent the further writing of sensitive data to persistent storage.

Public Exploit Available: exploit_available (unknown)

The exposure of encryption keys is a critical security failure that invalidates the protection of all affected backups. Organizations utilizing myhoard should prioritize upgrading to version 1.3.0 immediately and conduct a thorough audit of their logs to identify and rotate any keys that may have been leaked prior to the patch.