CVE-2026-103094

ServiceNow has remediated an information disclosure vulnerability that was identified in the ServiceNow AI Platform. This vulnerability could cause a user's plaintext password to be persisted in a system table, potentially exposing that password to a user who otherwise would not be entitled to view it. ServiceNow remediated the vulnerability through security updates that address the unintended persistence of plaintext credentials. We are not currently aware of malicious exploitation against ServiceNow instances. We recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so.

• CWE-256

• https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB3228994

Published

Oct 29, 2026

Last Modified

Oct 29, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-103087Uncontrolled recursion in the Gosub browser engine (gosub-en…7.1
• CVE-2026-103088Handlebars.java before 4.5.5 allows directory traversal. In …7.5
• CVE-2026-103090Missing Authentication for Critical Function (CWE-306) and I…8.8
• CVE-2026-103091Missing Authorization (CWE-862) and Initialization of a Reso…9.3
• CVE-2026-103092IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote a…8.5
• CVE-2026-103093ServiceNow has remediated a sandbox escape security issue th…9.4
• CVE-2026-103096API key is hardcoded and retrievable from the application pa…7.5
• CVE-2026-103097An API key is hardcoded and retrievable from the application…7.5
• CVE-2026-103098Transmission of a sensitive key in the URL over an unencrypt…7.5
• CVE-2026-103099Pexip Infinity before 41.1 is affected by improper input val…7.5
• CVE-2026-1031IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2…6.1
• CVE-2026-103100Pexip Infinity before 40.1 is affected by improper input val…7.5