Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-55102— hashi-vault-js: Vault token and secret values exposed in thrown errors

Quick assessment

Affected
kyndryl-open-source hashi-vault-js
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

以下是该漏洞描述的中文翻译： hashi-vault-js 是一个用于与 HashiCorp Vault API 进行交互的 Node.js 模块。在 0.5.2 版本之前， 中的所有 API 方法都会将失败的请求通过 函数处理，该函数会重新抛出原始的 ，并保留其 属性以及相应的响应配置。这些对象可能包含 请求头以及 中的请求体，其中包括提交的密码或机密值。如果使用该模块的应用程序通过控制台日志、结构化日志记录器、监控系统、崩溃报告或应用程序性能监控服务来记录捕获的异常，那么活跃的 Vault 令牌和请求中的机密信

CVSS 5.8 · Medium EPSS 0.11% · P2

Possible ATT&CK Techniques 1 AI

T1556 · Modify Authentication Process

Affected Version Matrix 1

VendorProduct Version RangeStatus
kyndryl-open-source hashi-vault-js < 0.5.2 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-55102

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
hashi-vault-js: Vault token and secret values exposed in thrown errors
Source: CVE Program / CVE List V5
Vulnerability Description
hashi-vault-js is a Node.js module for interacting with the HashiCorp Vault API. Prior to 0.5.2, every API method in src/Vault.js passes failed requests through parseAxiosError(), which rethrows the raw AxiosError while retaining AxiosError.config and the equivalent response configuration. These objects can contain the X-Vault-Token request header and err.config.data request body, including submitted passwords or secret values. When a consuming application records the caught exception through console logging, structured loggers, monitoring, crash reporting, or an application performance monitoring service, the live Vault token and request secrets can be stored in plaintext and exposed to anyone with access to that output. A stolen token can permit unauthorized access to the Vault instance under the token's policies. This issue is fixed in version 0.5.2.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过错误消息导致的信息暴露
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
kyndryl-open-source hashi-vault-js < 0.5.2 -

II. Public POCs for CVE-2026-55102

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-55102

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-55102 (3)

Vendor Advisories for CVE-2026-55102 (1)

IV. Related Vulnerabilities

Same product: hashi-vault-js
Same vendor: kyndryl-open-source
Same weakness: CWE-209

V. Comments for CVE-2026-55102

No comments yet

Leave a comment