Sensitive Data Exposure in HashiCorp Vault API Integration
CVE-2026-55102
5.8MEDIUM
What is CVE-2026-55102?
The hashi-vault-js Node.js module, prior to version 0.5.2, contains a vulnerability where failed API requests can inadvertently expose sensitive information, including Vault tokens and payloads. When errors occur and are logged without proper sanitization, there's a risk that sensitive data may be recorded in plaintext. This could grant malicious actors unauthorized access to the Vault instance, compromising secret management practices. Users are advised to update to version 0.5.2 or later to mitigate these risks.
Affected Version(s)
hashi-vault-js < 0.5.2