CVE-2026-82372 in SANnav
Summary
by MITRE • 09/24/2026
Improper handling of sensitive data during IPsec policy creation and modification in Brocade SANnav versions before 3.0.1a results in pre-shared keys being recorded in application logs. Individuals with read access to system log files or support bundles can view these credentials, leading to the potential exposure of keys used to secure network tunnels.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/25/2026
The vulnerability identified involves an improper handling of sensitive data within Brocade SANnav software versions prior to 3.0.1a, specifically during the processes of creating and modifying IPsec policies. This flaw manifests as a critical information disclosure issue where pre-shared keys (PSKs), which are essential for authenticating Internet Protocol Security tunnels, are inadvertently written in plaintext or insufficiently protected formats into application log files. The root cause lies in the logging mechanism failing to sanitize sensitive input parameters before persisting them to disk, resulting in credentials being stored alongside routine operational data rather than being masked or excluded entirely from audit trails.
From a technical perspective, this represents a classic case of insecure storage and improper output handling for security-critical information. When administrators configure IPsec policies through the SANnav interface, the system captures configuration details for auditing purposes but neglects to apply necessary redaction rules to authentication secrets. Consequently, any entity with read access to these log files or support bundles generated by the application can extract the pre-shared keys directly from the text logs. This exposure bypasses standard access controls that might protect other parts of the system because log files are often accessible for troubleshooting and diagnostic purposes, creating a significant attack surface where credentials intended for network-level authentication become visible at the file system level.
The operational impact of this vulnerability is severe, as it compromises the confidentiality and integrity of IPsec communications managed by SANnav. Pre-shared keys serve as the primary mechanism for establishing trust between peers in an IPsec tunnel; their exposure allows attackers to impersonate legitimate devices or decrypt traffic traversing these tunnels if they can also intercept network packets. This undermines the security posture of the storage area network infrastructure, potentially leading to unauthorized access to sensitive data stored on SAN devices and facilitating further lateral movement within the enterprise network. The risk is amplified in environments where log files are centralized for monitoring purposes, as a single compromise of the logging server could yield credentials for multiple IPsec connections across the organization.
This vulnerability aligns with CWE-532, which covers information exposure through log files, and maps to MITRE ATT&CK technique T1078, specifically valid accounts or credential access via system logs. To mitigate this risk, organizations running affected versions of Brocade SANnav must immediately upgrade to version 3.0.1a or later where the logging behavior has been corrected to exclude sensitive parameters from log output. In addition to upgrading, administrators should review existing log files for any residual exposure of pre-shared keys and rotate those credentials if they were previously logged in plaintext. Implementing strict file permissions on log directories and employing centralized security information and event management solutions with built-in data loss prevention features can further reduce the risk of credential leakage from operational logs.