Unverified50% confidenceFactExact time
v2.1.286 fixes multiple key redaction issues, including no longer exposing credential values when Bearer or Basic appears before the key name in error messages, and the issue of percent-encoded Bearer tokens being only partially masked.
1
Sources
50%
Confidence
Medium-term (~90 days)
Relevance
9/30/2026
First Seen
Valid until: 12/29/2026
Sources
Related Entities
Related Claims
UnverifiedFixed credential and authentication header leakage issues on multiple platforms including Bedrock, Vertex, and Foundry, including a problem where residual Anthropic API keys were being sent alongside Foundry subscription key mode requests.72% similarUnverifiedThe vulnerability fixed in version 0.65.5 is: when the requested table name contains a trailing newline character at the end, it is possible to bypass table-level permission checks and expose private row data that should be protected.70% similarUnverifiedThe root cause of keychain migration failure is that the encryption key is sealed within the source device's Secure Enclave and cannot be exported, leaving the target device unable to provide the same hardware key for decryption69% similarUnverified怀疑执行过恶意版本后应默认所有敏感凭证（npm token、云服务密钥、Git/SSH凭证、CI secret）已泄露并立即轮换69% similarUnverifiedThe new version fixes a secret leakage issue where plugin and marketplace error messages displayed tokens or passwords in git source URLs, as well as an issue where /mcp and /plugin server details displayed secrets resolved from ${VAR} placeholders.68% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/963073API
curl https://kongchang.com/api/v1/knowledge/claims/963073MCP
get_claim(id=963073)