Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.6

Kanidm provision tool exposes admin passwords in logs

CVE-2025-30205 · published 1 year ago
Summary

The kanidm‑provision utility before version 1.2.0 can write the admin or idm_admin passwords to the system log when its optional patches are used. This could let anyone who can read the logs see those credentials. Update the tool to version 1.2.0 or later, or raise the log level above "info" (for example to "warn") to stop the passwords from being logged.

Original advisory text
kanidm-provision leaks provisioned admin credentials into the system log
kanidim-provision is a helper utility that uses kanidm's API to provision users, groups and oauth2 systems. Prior to version 1.2.0, a faulty function intrumentation in the (optional) kanidm patches provided by kandim-provision will cause the provisioned admin credentials to be leaked to the system log. This only impacts users which both use the provided patches and provision their `admin` or `idm_admin` account credentials this way. No other credentials are affected. Users should recompile kanidm with the newest patchset from tag `v1.2.0` or higher. As a workaround, the user can set the log level `KANIDM_LOG_LEVEL` to any level higher than `info`, for example `warn`.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
7.6 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-532Insertion of Sensitive Information into Log File
Timeline
Published24 Mar 2025
Updated3 Nov 2026
First seen7 Mar 2026
Sources
CVE-2025-30205 · NVD
CVE-2025-30205 · OSV
GHSA-57fc-pcqm-53rp · GHSA
Track software like this
Free during beta