GHSA-5PQ8-3FFP-7W5M
Vulnerability from github – Published: 2026-08-13 14:14 – Updated: 2026-08-13 14:14Summary
Vault token and secret values are exposed in thrown errors when using hashi-vault-js.
Details
Every API method in Vault.js executes throw parseAxiosError(err), which returns the raw AxiosError untouched. That error carries the full Axios configuration, including the X-Vault-Token header and the request body. Consuming applications that log caught errors (e.g., using console.error, pino, winston, Sentry, or APMs) inadvertently log the live Vault token in plaintext. Furthermore, write-path methods expose submitted passwords and secret values via err.config.data.
Impact
When consuming applications log intercepted exceptions, sensitive credentials such as tokens, passwords, and secrets are unknowingly exposed to application logs, monitoring services, and APM systems via the raw AxiosError. This may lead to authorization bypass or unauthorized access to the underlying Vault instance.
Patches
This vulnerability should be addressed by redacting err.config.headers['X-Vault-Token'] and err.config.data before re-throwing, or by throwing a purpose-built error containing only safe properties like status and message. Users should upgrade to a version that includes this fix.
Workarounds
If users cannot immediately update the library, they can mitigate this issue by capturing all exceptions thrown by hashi-vault-js and sanitizing or omitting the err.config object before passing the errors to logging utilities or crash reporters.
Acknowledgements
hashi-vault-js would like to thank Sebastián Alba Vives for reporting this vulnerability.
Resources
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 0.5.1"
},
"package": {
"ecosystem": "npm",
"name": "hashi-vault-js"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.5.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-55102"
],
"database_specific": {
"cwe_ids": [
"CWE-209",
"CWE-532"
],
"github_reviewed": true,
"github_reviewed_at": "2026-08-13T14:14:32Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "## Summary\n\nVault token and secret values are exposed in thrown errors when using `hashi-vault-js`.\n\n## Details\n\nEvery API method in `Vault.js` executes `throw parseAxiosError(err)`, which returns the raw `AxiosError` untouched. That error carries the full Axios configuration, including the `X-Vault-Token` header and the request body. Consuming applications that log caught errors (e.g., using `console.error`, `pino`, `winston`, Sentry, or APMs) inadvertently log the live Vault token in plaintext. Furthermore, write-path methods expose submitted passwords and secret values via `err.config.data`.\n\n## Impact\n\nWhen consuming applications log intercepted exceptions, sensitive credentials such as tokens, passwords, and secrets are unknowingly exposed to application logs, monitoring services, and APM systems via the raw `AxiosError`. This may lead to authorization bypass or unauthorized access to the underlying Vault instance.\n\n## Patches\n\nThis vulnerability should be addressed by redacting `err.config.headers[\u0027X-Vault-Token\u0027]` and `err.config.data` before re-throwing, or by throwing a purpose-built error containing only safe properties like status and message. Users should upgrade to a version that includes this fix.\n\n## Workarounds\n\nIf users cannot immediately update the library, they can mitigate this issue by capturing all exceptions thrown by `hashi-vault-js` and sanitizing or omitting the `err.config` object before passing the errors to logging utilities or crash reporters.\n\n## Acknowledgements\nhashi-vault-js would like to thank Sebasti\u00e1n Alba Vives for reporting this vulnerability.\n\n## Resources\n\n- [CWE-532: Insertion of Sensitive Information into Log File](https://cwe.mitre.org/data/definitions/532.html)\n- [CWE-209: Generation of Error Message Containing Sensitive Information](https://cwe.mitre.org/data/definitions/209.html)",
"id": "GHSA-5pq8-3ffp-7w5m",
"modified": "2026-08-13T14:14:32Z",
"published": "2026-08-13T14:14:32Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/kyndryl-open-source/hashi-vault-js/security/advisories/GHSA-5pq8-3ffp-7w5m"
},
{
"type": "PACKAGE",
"url": "https://github.com/kyndryl-open-source/hashi-vault-js"
}
],
"schema_version": "1.4.0",
"severity": [],
"summary": "hashi-vault-js: Vault token and secret values exposed in thrown errors"
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.