Netatalk 2.1.0 through 4.4.2 inserts LDAP simple-bind passwords into log output in cleartext, creating a vulnerability that allows an attacker who can read these logs to obtain LDAP credentials. This credential compromise can enable unauthorized access and lateral movement within the network. The flaw is a direct manifestation of CWE-532, where sensitive information is inadvertently recorded in logs.

The affected product is Netatalk, a server implementation of the AppleTalk protocol suite. All releases from 2.1.0 up to and including 4.4.2 are impacted; the issue was addressed in version 4.4.3 and later.

The CVSS score of 7.5 indicates a high severity, primarily due to the confidentiality impact of exposed passwords. EPSS data is not available, so current exploitation probability is unclear, but the absence of KEV listing suggests no known active exploitation campaigns. The likely attack vector is through anyone who gains read access to the server’s log files, which may be local or remote if logs are accessible over a network. An attacker exploiting this flaw gains plaintext credentials, enabling impersonation or further compromise of user accounts.