{"id":"CVE-2026-118467","kind":"vulnerability","aliases":["CVE-2026-118467"],"related":[],"title":"Shared telemetry and logging leak patient and doctor identifiers unprotected","description":"Shared telemetry and logging components store or transmit patient and doctor identifiers, clinical information, and low-entropy identifiers without adequate pseudonymization or protection.","summary":"Shared telemetry and logging components store or transmit patient and doctor identifiers and clinical information without adequate pseudonymization. Someone who can reach those logs or telemetry streams could read sensitive health-related data.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["healthcare","logging","other","telemetry"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-09T12:16:37+00:00","first_seen_at":"2026-11-09T12:26:23+00:00","triaged_at":"2026-11-09T12:27:26+00:00","updated_at":"2026-11-09T12:27:26+00:00","category":"other","confidence":0.4,"triage":{"at":"2026-11-09T12:27:26Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Shared telemetry and logging leak patient and doctor identifiers unprotected","impact":"medium","summary":"Shared telemetry and logging components store or transmit patient and doctor identifiers and clinical information without adequate pseudonymization. Someone who can reach those logs or telemetry streams could read sensitive health-related data.","audience":"businesses","category":"other","nicknames":[],"who_cares":["healthcare","telemetry","logging"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Patient and doctor identifiers and clinical data exposed from logs","analyst_note":"Identify the affected product and vendor from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-118467; the description names no product or version.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00065,"input_tokens":4506,"output_tokens":398,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-118467':13A,16A '-2026':12A,15A 'adequ':37B,75C 'clinic':34B,67C 'compon':25B,59C 'could':48B 'cve':11A,14A 'data':54B 'doctor':8A,31B,65C 'entropi':72C 'health':52B 'health-rel':51B 'healthcar':17B 'identifi':9A,32B,66C,73C 'inform':35B,68C 'leak':5A 'log':4A,18B,24B,44B,58C 'low':71C 'low-entropi':70C 'patient':6A,29B,63C 'protect':78C 'pseudonym':38B,76C 'reach':42B 'read':49B 'relat':53B 'sensit':50B 'share':1A,21B,55C 'someon':39B 'store':26B,60C 'stream':47B 'telemetri':2A,20B,22B,46B,56C 'transmit':28B,62C 'unprotect':10A 'without':36B,74C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["healthcare","logging","medium","other","telemetry"],"campaign_type":null,"search_a":"'-118467':13A,16A '-2026':12A,15A 'cve':11A,14A 'doctor':8A 'identifi':9A 'leak':5A 'log':4A 'patient':6A 'share':1A 'telemetri':2A 'unprotect':10A","search_b":"'adequ':37B 'clinic':34B 'compon':25B 'could':48B 'data':54B 'doctor':31B 'health':52B 'health-rel':51B 'healthcar':17B 'identifi':32B 'inform':35B 'log':18B,24B,44B 'patient':29B 'pseudonym':38B 'reach':42B 'read':49B 'relat':53B 'sensit':50B 'share':21B 'someon':39B 'store':26B 'stream':47B 'telemetri':20B,22B,46B 'transmit':28B 'without':36B","search_c":"'adequ':75C 'clinic':67C 'compon':59C 'doctor':65C 'entropi':72C 'identifi':66C,73C 'inform':68C 'log':58C 'low':71C 'low-entropi':70C 'patient':63C 'protect':78C 'pseudonym':76C 'share':55C 'store':60C 'telemetri':56C 'transmit':62C 'without':74C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T12:16:37+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118467","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118467","severity":null,"published_at":"2026-11-09T12:16:37+00:00","modified_at":"2026-11-09T12:16:37+00:00","first_seen_at":"2026-11-09T12:26:23+00:00","fetched_at":"2026-11-09T12:26:23+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}