Log in Start free

Vulnerability · Published Sep 14, 2026 · Assigned by GitHub_M

CVE-2026-55102hashi-vault-js: Vault token and secret values exposed in thrown errors

Medium 5.8

In plain English

A medium-severity sensitive data in logs in hashi-vault-js from kyndryl-open-source. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)5.8Medium
Exploit odds (30 days)0.2%top 94.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

hashi-vault-js is a Node.js module for interacting with the HashiCorp Vault API. Prior to 0.5.2, every API method in src/Vault.js passes failed requests through parseAxiosError(), which rethrows the raw AxiosError while retaining AxiosError.config and the equivalent response configuration. These objects can contain the X-Vault-Token request header and err.config.data request body, including submitted passwords or secret values. When a consuming application records the caught exception through console logging, structured loggers, monitoring, crash reporting, or an application performance monitoring service, the live Vault token and request secrets can be stored in plaintext and exposed to anyone with access to that output. A stolen token can permit unauthorized access to the Vault instance under the token's policies. This issue is fixed in version 0.5.2.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
npmhashi-vault-js0.5.2GHSA-5pq8-3ffp-7w5m

Affected products (as reported)

VendorProductVersions
kyndryl-open-source hashi-vault-js < 0.5.2

Weakness: CWE-209, CWE-532 · Vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N

References