kyndryl-open-source hashi-vault-js up to 0.5.1 src/Vault.js parseAxiosError missing encryption

Summaryinfo

A vulnerability described as problematic has been identified in kyndryl-open-source hashi-vault-js up to 0.5.1. The affected element is the function parseAxiosError of the file src/Vault.js. Executing a manipulation can lead to missing encryption. This vulnerability appears as CVE-2026-55102. The attack requires local access. There is no available exploit. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability has been found in kyndryl-open-source hashi-vault-js up to 0.5.1 and classified as problematic. This vulnerability affects the function parseAxiosError of the file src/Vault.js. The manipulation with an unknown input leads to a missing encryption vulnerability. The CWE definition for the vulnerability is CWE-311. The product does not encrypt sensitive or critical information before storage or transmission. As an impact it is known to affect confidentiality. CVE summarizes:

hashi-vault-js is a Node.js module for interacting with the HashiCorp Vault API. Prior to 0.5.2, every API method in src/Vault.js passes failed requests through parseAxiosError(), which rethrows the raw AxiosError while retaining AxiosError.config and the equivalent response configuration. These objects can contain the X-Vault-Token request header and err.config.data request body, including submitted passwords or secret values. When a consuming application records the caught exception through console logging, structured loggers, monitoring, crash reporting, or an application performance monitoring service, the live Vault token and request secrets can be stored in plaintext and exposed to anyone with access to that output. A stolen token can permit unauthorized access to the Vault instance under the token's policies. This issue is fixed in version 0.5.2.

The advisory is available at github.com. This vulnerability was named CVE-2026-55102 since 06/16/2026. The exploitation appears to be difficult. Local access is required to approach this attack. Technical details are known, but there is no available exploit. This vulnerability is assigned to T1600 by the MITRE ATT&CK project.

Upgrading to version 0.5.2 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• kyndryl-open-source

Name

• hashi-vault-js

Version

• 0.5.0
• 0.5.1

License

• open-source

Website

• Product: https://github.com/kyndryl-open-source/hashi-vault-js/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion