GHSA-gcqf-f89c-68hv

Source

https://github.com/advisories/GHSA-gcqf-f89c-68hv

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/05/GHSA-gcqf-f89c-68hv/GHSA-gcqf-f89c-68hv.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-gcqf-f89c-68hv

Aliases

Related

Published

2025-05-02T15:31:49Z

Modified

2025-05-07T06:27:17.653921Z

Severity

4.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N CVSS Calculator

Summary

Hashicorp Vault Community vulnerable to Generation of Error Message Containing Sensitive Information

Details

Vault Community and Vault Enterprise Key/Value (kv) Version 2 plugin may unintentionally expose sensitive information in server and audit logs when users submit malformed payloads during secret creation or update operations via the Vault REST API. This vulnerability, identified as CVE-2025-4166, is fixed in Vault Community 1.19.3 and Vault Enterprise 1.19.3, 1.18.9, 1.17.16, 1.16.20.

Database specific

{
    "nvd_published_at": "2025-05-02T15:15:50Z",
    "cwe_ids": [
        "CWE-209"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2025-05-02T19:31:47Z"
}

References

Affected packages

Go / github.com/hashicorp/vault

Package

Name: github.com/hashicorp/vault; View open source insights on deps.dev
Purl: pkg:golang/github.com/hashicorp/vault

Affected ranges

Type: SEMVER
Events: Introduced

0.3.0

Fixed

1.19.3