Unrated

Sensitive information exposure in hashi-vault-js error handling

IdentifiersCVE-2026-55102CWE-209

CVE-2026-55102 is an information exposure vulnerability in hashi-vault-js in which raw AxiosError objects are re-thrown without adequate sanitization. Because the exception object can retain HTTP request metadata, including authorization headers and request body content, sensitive Vault-related material such as tokens, passwords, and secret values may be exposed when applications capture and log these errors. The issue stems from improper handling of error objects returned during failed requests to Vault, allowing confidential data to propagate into downstream logging and observability systems.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation can disclose live authentication tokens, passwords, and other secret material associated with Vault operations. In environments where application exceptions are forwarded to logs, monitoring platforms, crash reporting systems, or APM tooling, an attacker who gains access to those records may obtain credentials or secrets sufficient to access the Vault instance, retrieve protected data, or bypass intended authorization boundaries.

Mitigation

If you can’t patch tonight, do this now.

If an immediate upgrade is not possible, intercept exceptions originating from hashi-vault-js and sanitize or remove sensitive properties before they are logged or transmitted to monitoring and telemetry systems. In particular, avoid recording request configuration data embedded in thrown Axios-derived errors, and restrict access to existing logs that may already contain exposed secrets.

Remediation

Patch, then assume compromise.

Upgrade hashi-vault-js to version 0.5.2 or later. The fixed version is expected to redact sensitive request components, including Vault authentication headers and request body data, before re-throwing errors. After upgrading, review error-handling and logging pipelines to confirm that sensitive exception fields are not persisted or exported.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

ACTIVITY FEED

Recent activity

No public activity tracked yet. Mallory keeps watching.

0 SOURCESView more in app

No public activity observed for this vulnerability.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity