{"id":"CVE-2023-1550","aliases":["BIT-nginx-agent-2023-1550","EUVD-2023-23784","GHSA-68qv-j282-p3jm"],"status":"published","title":"NGINX Agent vulnerability CVE-2023-1550","description":"Insertion of Sensitive Information into log file vulnerability in NGINX Agent. NGINX Agent version 2.0 before 2.23.3 inserts sensitive information into a log file. An authenticated attacker with local access to read agent log files may gain access to private keys. This issue is only exposed when the non-default trace level logging is enabled. Note: NGINX Agent is included with NGINX Instance Manager and used in conjunction with NGINX API Connectivity Manager, and NGINX Management Suite Security Monitoring.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00218,"percentile":0.12418,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-532"],"published":"2023-03-29T16:34:38Z","modified":"2026-10-24T10:30:15Z","fixes":[{"ecosystem":"Bitnami","package":"nginx-agent","fixed_in":["2.23.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Bitnami","package":"nginx-agent","ranges":[{"type":"SEMVER","events":[{"introduced":"2.0.0"},{"fixed":"2.23.3"}]}]}],"products":[{"vendor":"f5","product":"nginx agent"},{"vendor":"f5","product":"nginx_agent"},{"vendor":"f5","product":"nginx_instance_manager"}],"references":[{"url":"https://my.f5.com/manage/s/article/K000133135","tags":["x_transferred","Vendor Advisory","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20230511-0008/","tags":["x_transferred","web","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-1550","tags":["web"]},{"url":"https://github.com/advisories/GHSA-68qv-j282-p3jm"}],"sources":{"cve":[{"id":"CVE-2023-1550","title":"NGINX Agent vulnerability CVE-2023-1550","description":"Insertion of Sensitive Information into log file vulnerability in NGINX Agent. NGINX Agent version 2.0 before 2.23.3 inserts sensitive information into a log file. An authenticated attacker with local access to read agent log files may gain access to private keys. This issue is only exposed when the non-default trace level logging is enabled. Note: NGINX Agent is included with NGINX Instance Manager and used in conjunction with NGINX API Connectivity Manager, and NGINX Management Suite Security Monitoring.","status":"published","published":"2023-03-29T16:34:38.119Z","modified":"2025-02-13T16:39:29.086Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T14:35:31.657022Z"}],"euvd":[{"id":"EUVD-2023-23784","description":"Insertion of Sensitive Information into log file vulnerability in NGINX Agent. NGINX Agent version 2.0 before 2.23.3 inserts sensitive information into a log file. An authenticated attacker with local access to read agent log files may gain access to private keys. This issue is only exposed when the non-default trace level logging is enabled. Note: NGINX Agent is included with NGINX Instance Manager and used in conjunction with NGINX API Connectivity Manager, and NGINX Management Suite Security Monitoring.","status":"published","published":"2023-03-29T16:34:38Z","modified":"2025-02-13T16:39:29Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T00:03:51.861062Z"}],"ghsa":[{"id":"GHSA-68qv-j282-p3jm","title":"Insertion of Sensitive Information into log file vulnerability in NGINX Agent. NGINX Agent...","description":"Insertion of Sensitive Information into log file vulnerability in NGINX Agent. NGINX Agent version 2.0 before 2.23.3 inserts sensitive information into a log file. An authenticated attacker with local access to read agent log files may gain access to private keys. This issue is only exposed when the non-default trace level logging is enabled. Note: NGINX Agent is included with NGINX Instance Manager and used in conjunction with NGINX API Connectivity Manager, and NGINX Management Suite Security Monitoring.","status":"published","published":"2023-03-29T18:30:29Z","modified":"2023-05-11T15:30:21Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T14:54:35.04449Z"}],"nvd":[{"id":"CVE-2023-1550","description":"Insertion of Sensitive Information into log file vulnerability in NGINX Agent. NGINX Agent version 2.0 before 2.23.3 inserts sensitive information into a log file. An authenticated attacker with local access to read agent log files may gain access to private keys. This issue is only exposed when the non-default trace level logging is enabled. Note: NGINX Agent is included with NGINX Instance Manager and used in conjunction with NGINX API Connectivity Manager, and NGINX Management Suite Security Monitoring.","status":"published","published":"2023-03-29T17:15:07.107Z","modified":"2026-06-17T05:28:14.39Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T14:07:51.883939Z"}],"osv":[{"id":"CVE-2023-1550","description":"Insertion of Sensitive Information into log file vulnerability in NGINX Agent. NGINX Agent version 2.0 before 2.23.3 inserts sensitive information into a log file. An authenticated attacker with local access to read agent log files may gain access to private keys. This issue is only exposed when the non-default trace level logging is enabled. Note: NGINX Agent is included with NGINX Instance Manager and used in conjunction with NGINX API Connectivity Manager, and NGINX Management Suite Security Monitoring.","status":"published","published":"2023-03-29T17:15:07.107Z","modified":"2026-10-24T10:30:15.176087358Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:29.487253Z"},{"id":"BIT-nginx-agent-2023-1550","title":"NGINX Agent vulnerability CVE-2023-1550","description":"Insertion of Sensitive Information into log file vulnerability in NGINX Agent. NGINX Agent version 2.0 before 2.23.3 inserts sensitive information into a log file. An authenticated attacker with local access to read agent log files may gain access to private keys. This issue is only exposed when the non-default trace level logging is enabled. Note: NGINX Agent is included with NGINX Instance Manager and used in conjunction with NGINX API Connectivity Manager, and NGINX Management Suite Security Monitoring.","status":"published","published":"2025-12-03T11:44:03.542Z","modified":"2026-09-08T08:48:16.049618886Z","updated_at":"2026-11-02T15:28:34.007508Z"}]}}