CVE-2026-22041: 
Python vulnerability analysis and mitigation

CVE-2026-22041 is an incorrect type conversion vulnerability in the Logging Redactor Python library (loggingredactor) that causes non-string types to be improperly cast to strings during log redaction, leading to type errors in %d format conversions. It affects all versions of loggingredactor prior to 0.0.6 (pip package by armurox). The vulnerability was reported in a GitHub issue on February 27, 2025, and the security advisory was published on January 7–8, 2026. It carries a CVSS v3.1 base score of 5.3 (Medium) and a CVSS v4.0 base score of 2.0 (Low) (GitHub Advisory, Feedly).

The root cause is classified as CWE-704 (Incorrect Type Conversion or Cast). Within the RedactingFilter.redact method, a one-liner expression — content_copy = isinstance(content_copy, str) and content_copy or str(content_copy) — unconditionally converts all non-string, non-iterable values to strings before applying redaction patterns. This means that when a log message contains non-string arguments (e.g., integers, booleans), they are coerced to strings, which then causes a TypeError when Python's logging framework attempts to apply %d-style format specifiers expecting an integer. The issue was originally reported by a community user and is documented in GitHub Issue #7 (GitHub Issue, GitHub Advisory).

The primary impact is on log integrity: when non-string types are coerced to strings by the redactor, sensitive data that should have been redacted may be exposed in logs in an unexpected format, or the redaction logic may fail entirely, leaving sensitive values unredacted. Additionally, the type coercion can cause TypeError exceptions during %d format string processing, potentially disrupting logging pipelines and producing malformed or missing log entries. There is no confidentiality or availability impact beyond the logging subsystem, and no remote code execution or privilege escalation is possible (GitHub Advisory, Feedly).

A proof-of-concept demonstrating the bug is publicly available via GitHub Issue #7, where a minimal reproduction case is provided. The EPSS score is approximately 0.013% (very low), and there is no evidence of in-the-wild exploitation or threat actor attribution. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is limited to scenarios where an attacker can influence log message arguments passed through the affected library (GitHub Issue, Feedly).

The vulnerability is fully patched in loggingredactor version 0.0.6, released on March 1, 2025 (tagged 2025-01-03). The fix corrects the RedactingFilter.redact method to preserve the original data types of non-string values rather than coercing them to strings. No workarounds are available for versions prior to 0.0.6; upgrading via pip (pip install --upgrade loggingredactor) is the only remediation path. Administrators should audit all environments using loggingredactor < 0.0.6 and prioritize upgrading (GitHub Release, GitHub Advisory).