The product inserts sensitive information into debugging code, which could expose this information if the debugging code is not disabled in production.

What CVEs are caused by CWE-215?

14 recorded CVEs are attributed to CWE-215, including CVE-2026-40173, CVE-2019-3781, CVE-2018-1191.

Is CWE-215 part of the OWASP Top 10?

CWE-215 maps to OWASP Top Ten 2007: Information Leakage and Improper Error Handling (A6) in the OWASP security taxonomy.

What are the consequences of CWE-215?

Exploiting CWE-215 can lead to: Read Application Data.

Is CWE-215 actively exploited?

14 recorded CVEs are caused by CWE-215; none are currently in CISA's KEV catalog of actively exploited flaws.

CWE-215: Insertion of Sensitive Information Into Debugging Code

Q: How do you prevent CWE-215?

Do not leave debug statements that could be executed in the source code. Ensure that all debug information is eradicated before releasing the software.

Q: How is CWE-215 detected?

Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

Overview

When debugging, it may be necessary to report detailed information to the programmer. However, if the debugging code is not disabled when the product is operating in a production environment, then this sensitive information may be exposed to attackers.

Real-world CVEs

14 recorded CVEs are caused by CWE-215 (Insertion of Sensitive Information Into Debugging Code). The highest-severity and most recent are shown first. 3 new CWE-215 CVEs have been recorded so far in 2026 (4 in 2025).

CVE-2026-40173
Dgraph: Unauthenticated pprof endpoint leaks admin auth token
Critical · CVSS 9.4 · EPSS 40th
2026-04-15
CVE-2019-3781
High · CVSS 8.8 · EPSS 68th
2019-03-07
CVE-2018-1191
High · CVSS 8.8 · EPSS 57th
2018-03-29
CVE-2026-33247
NATS credentials are exposed in monitoring port via command-line argv
High · CVSS 7.5 · EPSS 34th
2026-03-25
CVE-2025-27684
High · CVSS 7.5 · EPSS 42th
2025-03-05
CVE-2023-51390
High · CVSS 7.5 · EPSS 20th
2023-12-20
CVE-2026-44934
Exposed tokens in SUSE Rancher AI Agent logs
High · CVSS 7.0 · EPSS 2th
2026-07-06
CVE-2025-34081
CONPROSYS HMI System (CHS) < 3.7.7 Exposed PHP Debug Info
Medium · CVSS 6.9 · EPSS 45th
2025-07-01
CVE-2025-58598
WordPress Klarna Order Management for WooCommerce Plugin <= 1.9.8 - Sensitive Data Exposure Vulnerability
Medium · CVSS 6.6 · EPSS 16th
2025-09-03
CVE-2022-0721
Medium · CVSS 6.5 · EPSS 69th
2022-02-23
CVE-2023-49194
WordPress Importify (Dropshipping WooCommerce) plugin <= 1.0.4 - Sensitive Data Exposure vulnerability
Medium · CVSS 5.3 · EPSS 41th
2024-12-09
CVE-2018-1002104
Medium · CVSS 5.3 · EPSS 63th
2020-01-14

Showing 12 of 14 recorded CWE-215 CVEs. Track new ones as they are published and get AI-written analysis and fixes.

Monitor CWE-215 vulnerabilities

Common consequences

What can happen when CWE-215 is exploited.

Read Application Data

Affects: Confidentiality

How it happens

When it is introduced

Typically introduced during these phases of the software lifecycle.

Implementation

How to prevent it

Practical mitigations for CWE-215, grouped by where in the lifecycle they apply.

Implementation

Do not leave debug statements that could be executed in the source code. Ensure that all debug information is eradicated before releasing the software.

Architecture and Design

Separation of Privilege

Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.

Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.

How to detect it

Automated Static Analysis

Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

Effectiveness: High

Code examples

Illustrative examples from MITRE showing how the weakness appears in code.

The following program changes its behavior based on a debug flag.

Vulnerable example

jsp

<% if (Boolean.getBoolean("debugEnabled")) {

The code writes sensitive debug information to the client browser if the "debugEnabled" flag is set to true .

Illustrative examples

Real CVEs that MITRE cites as examples of this weakness.

CVE-2004-2268 — Password exposed in debug information.
CVE-2002-0918 — CGI script includes sensitive information in debug messages when an error is triggered.
CVE-2003-1078 — FTP client with debug option enabled shows password to the screen.

How this weakness relates to others in the CWE hierarchy.

Parent

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

Terminology & mappings

Mapped taxonomies

PLOVER: Infoleak Using Debug Information
OWASP Top Ten 2007: Information Leakage and Improper Error Handling (A6) — CWE More Specific fit
OWASP Top Ten 2004: Insecure Configuration Management (A10) — CWE More Specific fit
Software Fault Patterns: Exposed Data (SFP23)

Frequently asked questions

Common questions about CWE-215.

What is CWE-215?: The product inserts sensitive information into debugging code, which could expose this information if the debugging code is not disabled in production.
What CVEs are caused by CWE-215?: 14 recorded CVEs are attributed to CWE-215, including CVE-2026-40173, CVE-2019-3781, CVE-2018-1191.
Is CWE-215 part of the OWASP Top 10?: CWE-215 maps to OWASP Top Ten 2007: Information Leakage and Improper Error Handling (A6) in the OWASP security taxonomy.
How do you prevent CWE-215?: Do not leave debug statements that could be executed in the source code. Ensure that all debug information is eradicated before releasing the software.
How is CWE-215 detected?: Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
What are the consequences of CWE-215?: Exploiting CWE-215 can lead to: Read Application Data.
Is CWE-215 actively exploited?: 14 recorded CVEs are caused by CWE-215; none are currently in CISA's KEV catalog of actively exploited flaws.

References

Weakness data is sourced from the MITRE CWE catalog (v4.20). CVE associations are aggregated and kept current by RadicalNotion.AI.