MEDIUM4.5

GHSA-gcqf-f89c-68hv

Hashicorp Vault Community vulnerable to Generation of Error Message Containing Sensitive Information

Quick fix

GHSA-gcqf-f89c-68hv — github.com/hashicorp/vault: upgrade to the fixed version with the command below.

go get github.com/hashicorp/vault@v1.19.3

Details

Vault Community and Vault Enterprise Key/Value (kv) Version 2 plugin may unintentionally expose sensitive information in server and audit logs when users submit malformed payloads during secret creation or update operations via the Vault REST API. This vulnerability, identified as CVE-2025-4166, is fixed in Vault Community 1.19.3 and Vault Enterprise 1.19.3, 1.18.9, 1.17.16, 1.16.20.

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/github.com/hashicorp/vault

Introduced in: 0.3.0Fixed in: 1.19.3

Fixgo get github.com/hashicorp/vault@v1.19.3

References

https://nvd.nist.gov/vuln/detail/CVE-2025-4166[ADVISORY]
https://discuss.hashicorp.com/t/hcsec-2025-09-vault-may-expose-sensitive-information-in-error-logs-when-processing-malformed-data-with-the-kv-v2-plugin[WEB]
https://github.com/hashicorp/vault[PACKAGE]
https://pkg.go.dev/vuln/GO-2025-3663[WEB]