hashicorp / hashicorp/vault

VAULT_TOKEN leakage in Vault docker testcluster environment using version v0.25.1.

Open Beginner friendly
#32,036 6 comments 1 reaction 0 assignees View on GitHub
cryptosec docker
Dominant language
Go
Stars
36.3k
Forks
4.8k
PR merge metrics
PR metrics pending

Description

Hello,

While reviewing some of our Github Actions logging, we noticed leakage of our vault tokens in plain text. After reviewing the source code for the sdk, we found this line that prints the plaintext VAULT_TOKEN to STDOUT.

**Offending Code:**
https://github.com/hashicorp/vault/blob/2edd6c9264681067be77ed3f80966899664d26cc/sdk/helper/testcluster/docker/environment.go#L454

Contributor guide

Open the contributing guide

Research direction

Start in sdk/helper/testcluster/docker/environment.go at the linked line around 454 and trace how the Vault testcluster environment is written to STDOUT. Reproduce the logging path in the Docker testcluster or GitHub Actions context, then verify that VAULT_TOKEN no longer appears in plaintext output.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
devops, security
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
68/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.