Skip to content
CVE Tracker
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API documentationPage
  • MCP serverPage
  • Data sourcesPage
  • ChangelogPage
  • AboutPage
  • How it's builtPage
Back

CVE-2021-3036

PAN-OS: Administrator secrets are logged in web server logs when using the PAN-OS XML API incorrectly

Medium4.4EPSS 0.25%
Published
Updated
Reserved
Assigned by
palo_alto

Description

An information exposure through log file vulnerability exists in Palo Alto Networks PAN-OS software where secrets in PAN-OS XML API requests are logged in cleartext to the web server logs when the API is used incorrectly. This vulnerability applies only to PAN-OS appliances that are configured to use the PAN-OS XML API and exists only when a client includes a duplicate API parameter in API requests. Logged information includes the cleartext username, password, and API key of the administrator making the PAN-OS XML API request.

Scores

CVSS scores of CVE-2021-3036, by who scored it
Scored byCVSSScoreVector
palo_altoCNA (assigner)3.1Medium4.4CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
NVDNVD · Modified3.1Medium4.4CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
EPSS (exploitation in 30 days)
0.25% · top 84% of all CVEs (7 Nov 2026)
Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 4.4.

Weakness

Affected products

  • Palo Alto Networks · PAN-OS

    • affected 8.1 – < 8.1.19
    • affected 9.0 – < 9.0.12
    • affected 9.1 – < 9.1.6
    • affected 10.0 – < 10.0.1

What to do

Solution: This issue is fixed in PAN-OS 8.1.19, PAN-OS 9.0.12, PAN-OS 9.1.6, PAN-OS 10.0.1, and all later PAN-OS versions. After you upgrade the PAN-OS appliance, you must change the passwords and generate a new API key for all impacted PAN-OS administrators.

Workaround: You must change the passwords and generate a new API key for all impacted PAN-OS administrators. Confirm that there aren’t any PAN-OS XML API requests that repeat API parameters in the request.

Exploitation: Palo Alto Networks is not aware of any malicious exploitation of this issue.

References (1)

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

CVE-2021-3036 badge
[![CVE-2021-3036](https://trackcve.app/badge/CVE-2021-3036.svg)](https://trackcve.app/cve/CVE-2021-3036)

Record last updated .