CVE-2026-55102

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-55102
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55102.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-55102
Aliases
Published
2026-09-14T16:58:00Z
Modified
2026-09-16T03:46:58Z
Severity
  • 5.8 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N CVSS Calculator
Summary
hashi-vault-js: Vault token and secret values exposed in thrown errors
Details

hashi-vault-js is a Node.js module for interacting with the HashiCorp Vault API. Prior to 0.5.2, every API method in src/Vault.js passes failed requests through parseAxiosError(), which rethrows the raw AxiosError while retaining AxiosError.config and the equivalent response configuration. These objects can contain the X-Vault-Token request header and err.config.data request body, including submitted passwords or secret values. When a consuming application records the caught exception through console logging, structured loggers, monitoring, crash reporting, or an application performance monitoring service, the live Vault token and request secrets can be stored in plaintext and exposed to anyone with access to that output. A stolen token can permit unauthorized access to the Vault instance under the token's policies. This issue is fixed in version 0.5.2.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-209",
        "CWE-532"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55102.json"
}
References

Affected packages

Git / github.com/kyndryl-open-source/hashi-vault-js

Affected ranges

Type
GIT
Repo
https://github.com/kyndryl-open-source/hashi-vault-js
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
ed0797a2d09c1fe0fd20764dde66cbc29241d9fb
Fixed
0c82c8173214c988d50096a1e61a29ea7b6988af
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.5.2"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

0.*
0.5.1
v0.*
v0.5.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55102.json"