VAULT_TOKEN leakage in Vault docker testcluster environment using version v0.25.1.
- Dominant language
- Go
- Stars
- 36.3k
- Forks
- 4.8k
- PR merge metrics
- PR metrics pending
Description
Hello,
While reviewing some of our Github Actions logging, we noticed leakage of our vault tokens in plain text. After reviewing the source code for the sdk, we found this line that prints the plaintext VAULT_TOKEN to STDOUT.
**Offending Code:**
https://github.com/hashicorp/vault/blob/2edd6c9264681067be77ed3f80966899664d26cc/sdk/helper/testcluster/docker/environment.go#L454
Contributor guide
Research direction
Start in sdk/helper/testcluster/docker/environment.go at the linked line around 454 and trace how the Vault testcluster environment is written to STDOUT. Reproduce the logging path in the Docker testcluster or GitHub Actions context, then verify that VAULT_TOKEN no longer appears in plaintext output.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- devops, security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 68/100