CVE-2026-39937

OVERVIEW CVE-2026-39937 is an improper removal of sensitive information vulnerability in the Wikimedia Foundation's MediaWiki CentralAuth Extension. The flaw allows sensitive data to be inadvertently stored or transferred in an unprotected state, creating a resource leak exposure. The vulnerability affects MediaWiki versions prior to 1.43, 1.44, and 1.45, with patches available on the master branch and corresponding release branches. SEVERITY While a CVSS score has not been assigned, the FAUCET Risk Score of 51.0/100 indicates moderate concern. The vulnerability relates to improper handling of sensitive information, which typically involves network-adjacent or local attack vectors with minimal complexity. The primary impact is confidentiality-related, as sensitive data exposure could compromise user information or system credentials stored within the CentralAuth extension. EXPLOITATION STATUS There is no evidence of active exploitation. The vulnerability is not listed in the Known Exploited Vulnerabilities (KEV) catalog, has not achieved Hot List status, and carries an exceptionally low EPSS score of 0.00055, indicating minimal likelihood of exploitation. No public exploit code is known to be available, and community attention remains minimal at this time.