GHSA-fv92-fjc5-jj9h
ADVISORY - githubSummary
Summary
Use of this library in a security-critical context may result in leaking sensitive information, if used to process sensitive fields.
Details
OpenBao (and presumably HashiCorp Vault) have surfaced error messages from mapstructure as follows:
_, _, err := d.getPrimitive(field, schema)
if err != nil {
return fmt.Errorf("error converting input for field %q: %w", field, err)
}
where this calls mapstructure.WeakDecode(...): https://github.com/openbao/openbao/blob/98c3a59c040efca724353ca46ca79bd5cdbab920/sdk/framework/field_data.go#L181-L193
func (d *FieldData) getPrimitive(k string, schema *FieldSchema) (interface{}, bool, error) {
raw, ok := d.Raw[k]
if !ok {
return nil, false, nil
}
switch t := schema.Type; t {
case TypeBool:
var result bool
if err := mapstructure.WeakDecode(raw, &result); err != nil {
return nil, false, err
}
return result, true, nil
Notably, WeakDecode(...) eventually calls one of the decode helpers, which surfaces the original value:
& more.
PoC
To reproduce with OpenBao:
$ podman run -p 8300:8300 openbao/openbao:latest server -dev -dev-root-token-id=root -dev-listen-address=0.0.0.0:8300
and in a new tab:
$ BAO_TOKEN=root BAO_ADDR=http://localhost:8300 bao auth enable userpass
Success! Enabled userpass auth method at: userpass/
$ curl -X PUT -H "X-Vault-Request: true" -H "X-Vault-Token: root" -d '{"password":{"asdf":"my-sensitive-value"}}' "http://localhost:8300/v1/auth/userpass/users/adsf"
{"errors":["error converting input for field \"password\": '' expected type 'string', got unconvertible type 'map[string]interface {}', value: 'map[asdf:my-sensitive-value]'"]}
Impact
This is an information disclosure bug with little mitigation. See https://discuss.hashicorp.com/t/hcsec-2025-09-vault-may-expose-sensitive-information-in-error-logs-when-processing-malformed-data-with-the-kv-v2-plugin/74717 for a previous version. That version was fixed, but this is in the second part of that error message (starting at '' expected a map, got 'string' -- when the field type is string and a map is provided, we see the above information leak -- the previous example had a map type field with a string value provided).
This was rated 4.5 Medium by HashiCorp in the past iteration.
Common Weakness Enumeration (CWE)
Insertion of Sensitive Information into Log File
GitHub
1.6
CVSS SCORE
5.3mediumGoLang
-
Chainguard
CGA-244v-rj3j-2x42
-
Chainguard
CGA-2h6f-24v2-j5qg
-
Chainguard
CGA-2hwx-w2hc-qfcg
-
Chainguard
CGA-2rfr-f3w5-32wg
-
Chainguard
CGA-2w3w-hp7p-rwm7
-
Chainguard
CGA-32f5-qr8m-5p42
-
Chainguard
CGA-33m3-6cp5-4h3c
-
Chainguard
CGA-378h-w4f2-x232
-
Chainguard
CGA-3f66-jc99-q55c
-
Chainguard
CGA-3fp8-q9w3-m7r5
-
Chainguard
CGA-3fvv-3mv8-8645
-
Chainguard
CGA-3gmr-g3f4-4r33
-
Chainguard
CGA-3jv3-3376-49qv
-
Chainguard
CGA-3pfg-rfh3-vm8r
-
Chainguard
CGA-3vfh-rr7f-46wh
-
Chainguard
CGA-3wc9-83gf-fh65
-
Chainguard
CGA-3x2f-hgc6-58x5
-
Chainguard
CGA-3x98-fmrf-w23j
-
Chainguard
CGA-42wq-h5vj-5cxm
-
Chainguard
CGA-44p2-28fr-7gjp
-
Chainguard
CGA-4553-g358-83qq
-
Chainguard
CGA-45cv-h4rm-29h2
-
Chainguard
CGA-4f68-mvg3-q692
-
Chainguard
CGA-4fcf-8j4g-j5qm
-
Chainguard
CGA-4p3q-r4g5-gpxv
-
Chainguard
CGA-4v65-x4vv-c7rj
-
Chainguard
CGA-4vfj-vxv8-5p54
-
Chainguard
CGA-4wh6-h9gj-89ww
-
Chainguard
CGA-4whj-hccp-785f
-
Chainguard
CGA-4x32-97j4-wm9f
-
Chainguard
CGA-4xf2-3vxg-jg2w
-
Chainguard
CGA-523q-gc3g-c6j7
-
Chainguard
CGA-54gj-7h9x-fmj9
-
Chainguard
CGA-5827-jwrm-49qj
-
Chainguard
CGA-598p-9hhr-mc7c
-
Chainguard
CGA-5cj3-cfrx-p3h4
-
Chainguard
CGA-5hf7-7hr5-jxmp
-
Chainguard
CGA-5rgh-38cv-h5pq
-
Chainguard
CGA-5v76-m5r7-577m
-
Chainguard
CGA-62cc-92jj-x57c
-
Chainguard
CGA-656m-h9hf-98vp
-
Chainguard
CGA-65ww-m7g4-p3x8
-
Chainguard
CGA-6879-9559-49m6
-
Chainguard
CGA-69mj-gmfq-g3g6
-
Chainguard
CGA-6g8g-8h8f-hrhw
-
Chainguard
CGA-6p5f-rxfr-wx23
-
Chainguard
CGA-6p83-rjrg-j9jr
-
Chainguard
CGA-6pmj-4pv9-g3pv
-
Chainguard
CGA-6q3c-677f-4hjw
-
Chainguard
CGA-6rfw-9h63-hhv9
-
Chainguard
CGA-6rrj-w6x9-4h23
-
Chainguard
CGA-6w29-j652-r56q
-
Chainguard
CGA-738p-jj3g-f9h8
-
Chainguard
CGA-73p3-qf69-42f5
-
Chainguard
CGA-79h8-6c9g-jcwg
-
Chainguard
CGA-7c2g-7p47-wc84
-
Chainguard
CGA-7c2v-4ffj-c79f
-
Chainguard
CGA-7cv7-w462-46rw
-
Chainguard
CGA-7gm3-vpcm-mcx9
-
Chainguard
CGA-7hcx-rm85-53m7
-
Chainguard
CGA-7hmh-9mr5-ph25
-
Chainguard
CGA-7m48-hc5m-8jv3
-
Chainguard
CGA-7mjg-hjp5-jmxm
-
Chainguard
CGA-7mx5-2c79-9826
-
Chainguard
CGA-7qjc-5xc9-qchf
-
Chainguard
CGA-7r83-535h-xrcw
-
Chainguard
CGA-7wf9-8mr8-v7cj
-
Chainguard
CGA-848v-pjmj-c36p
-
Chainguard
CGA-89jw-6wqc-6cj7
-
Chainguard
CGA-8g62-px3j-x3gv
-
Chainguard
CGA-8p65-65pg-qh58
-
Chainguard
CGA-8q6x-346w-qw46
-
Chainguard
CGA-8whw-3336-rjcm
-
Chainguard
CGA-92v7-8fc8-3wg5
-
Chainguard
CGA-94pm-687v-mvm4
-
Chainguard
CGA-94q2-9cxp-84xm
-
Chainguard
CGA-9543-4vrh-xgg7
-
Chainguard
CGA-966j-v5ww-6rjc
-
Chainguard
CGA-98jc-27rq-86x3
-
Chainguard
CGA-9hpv-vjh5-7p8f
-
Chainguard
CGA-9j3v-j798-pxgx
-
Chainguard
CGA-9j7v-5346-6prq
-
Chainguard
CGA-9qr8-33w8-34gc
-
Chainguard
CGA-9xcx-rxrp-4p3c
-
Chainguard
CGA-c6rg-gq9c-25r4
-
Chainguard
CGA-c6rv-jrm4-4c9w
-
Chainguard
CGA-c83f-hj9r-g69j
-
Chainguard
CGA-c8m2-wpfg-2xj8
-
Chainguard
CGA-c9hw-rw9x-jfr4
-
Chainguard
CGA-ccwr-7v3q-fj74
-
Chainguard
CGA-cg43-8p55-8pcq
-
Chainguard
CGA-cgfg-r2r6-jr67
-
Chainguard
CGA-cq54-r58w-4x28
-
Chainguard
CGA-cwj2-rwcm-2g6q
-
Chainguard
CGA-f284-vmpw-vjx3
-
Chainguard
CGA-f36q-pxq2-fcrc
-
Chainguard
CGA-f3x7-vw7c-4v4f
-
Chainguard
CGA-f4mc-hjfp-gv4f
-
Chainguard
CGA-f6mc-2pg2-xj3j
-
Chainguard
CGA-f6p7-jp48-98xf
-
Chainguard
CGA-f6w3-qx2h-4qgp
-
Chainguard
CGA-fp93-xqcv-2vpp
-
Chainguard
CGA-fv4m-4gc8-8268
-
Chainguard
CGA-g28f-c29m-hw2p
-
Chainguard
CGA-g6xg-7qq4-r985
-
Chainguard
CGA-gcxm-g6wm-pf53
-
Chainguard
CGA-gfqw-6j74-cwfx
-
Chainguard
CGA-gfw7-pgvr-88mc
-
Chainguard
CGA-ggq8-cxgw-qjxv
-
Chainguard
CGA-gr7q-jgc7-54rq
-
Chainguard
CGA-h55c-c278-qc6f
-
Chainguard
CGA-h7mh-qhwq-hv88
-
Chainguard
CGA-h9jp-5c73-pxm8
-
Chainguard
CGA-hfg9-ffm6-5pq6
-
Chainguard
CGA-hj3p-376f-j387
-
Chainguard
CGA-hm7h-8f5p-6mpj
-
Chainguard
CGA-hpj5-w22w-v7ch
-
Chainguard
CGA-hqq3-675g-c8f5
-
Chainguard
CGA-hv58-w8x4-c23w
-
Chainguard
CGA-hwhm-6jj8-4wfc
-
Chainguard
CGA-j3xc-p63v-f5q9
-
Chainguard
CGA-j55f-r332-7gvw
-
Chainguard
CGA-j7p4-vmmp-rh2j
-
Chainguard
CGA-j82r-vhwp-q54j
-
Chainguard
CGA-jjmc-7r7j-h95m
-
Chainguard
CGA-jmcp-59jf-xpgj
-
Chainguard
CGA-jvv9-qxwp-c23q
-
Chainguard
CGA-jwm7-vrfq-mhff
-
Chainguard
CGA-jx6j-48fv-f5cc
-
Chainguard
CGA-m22g-537h-9v7x
-
Chainguard
CGA-m28x-j9vq-6hpp
-
Chainguard
CGA-m4jx-v5v4-x586
-
Chainguard
CGA-m6mw-6grp-pw57
-
Chainguard
CGA-m8c4-wgh3-cg5x
-
Chainguard
CGA-m8rx-957v-82qq
-
Chainguard
CGA-mf9w-fxm7-h355
-
Chainguard
CGA-mgmh-fx86-9gmw
-
Chainguard
CGA-mj5r-ccqr-g95g
-
Chainguard
CGA-mpm2-wgwj-rmq7
-
Chainguard
CGA-mw98-cfr7-jv47
-
Chainguard
CGA-mx37-99r5-wq6h
-
Chainguard
CGA-p26r-hq7f-3r2c
-
Chainguard
CGA-p29v-5pc2-7383
-
Chainguard
CGA-p478-57mq-j6q4
-
Chainguard
CGA-p83v-h8hm-9pp6
-
Chainguard
CGA-pg72-8g7j-6v25
-
Chainguard
CGA-pm9q-q9wg-484r
-
Chainguard
CGA-pmc7-82wx-fmvm
-
Chainguard
CGA-ppgp-9j4q-5ww5
-
Chainguard
CGA-ppm3-xgwh-xfqq
-
Chainguard
CGA-pvc9-g3q9-gm43
-
Chainguard
CGA-q396-crfg-qq8r
-
Chainguard
CGA-q5xf-g679-v4gq
-
Chainguard
CGA-q64v-26v3-xmp8
-
Chainguard
CGA-qfvg-4jp7-2589
-
Chainguard
CGA-qg9f-jw8x-wv4h
-
Chainguard
CGA-qx32-p2p2-fpfx
-
Chainguard
CGA-r4h5-g3r9-vfvx
-
Chainguard
CGA-r5j4-vf38-wx2g
-
Chainguard
CGA-r6hg-4pqr-2jx7
-
Chainguard
CGA-r7pq-h44w-849w
-
Chainguard
CGA-r7qm-5495-cmpq
-
Chainguard
CGA-r8qg-4558-xvfc
-
Chainguard
CGA-rg29-gmw2-g6rc
-
Chainguard
CGA-rg64-xfp3-r4pp
-
Chainguard
CGA-rjx2-7m62-3m53
-
Chainguard
CGA-rpqv-pqq3-6652
-
Chainguard
CGA-rr5r-3wr6-p7rp
-
Chainguard
CGA-v2m2-x468-67c3
-
Chainguard
CGA-v538-pwch-3q93
-
Chainguard
CGA-vc6m-ffw4-wwqw
-
Chainguard
CGA-vh33-f6wf-rmp7
-
Chainguard
CGA-vhf6-3gh3-9c69
-
Chainguard
CGA-vj3x-699g-q6jg
-
Chainguard
CGA-vp5q-g93r-42xp
-
Chainguard
CGA-w45q-rjjq-7cfc
-
Chainguard
CGA-w825-836w-2w9g
-
Chainguard
CGA-w86r-pffm-55cc
-
Chainguard
CGA-w975-c4f8-45q3
-
Chainguard
CGA-w9r3-f9ph-rv9m
-
Chainguard
CGA-wh75-6393-93gr
-
Chainguard
CGA-wwgw-4qxh-g42f
-
Chainguard
CGA-wwqf-m95f-qc23
-
Chainguard
CGA-wxc4-wm8x-2m9f
-
Chainguard
CGA-x4qw-9cwp-8793
-
Chainguard
CGA-x6xm-4jp3-j76m
-
Chainguard
CGA-x8wq-h8w3-jcxr
-
Chainguard
CGA-x9gw-37hf-x7xm
-
Chainguard
CGA-xff4-8fh6-gwjf
-
Chainguard
CGA-xfh3-p4m3-9j8h
-
Chainguard
CGA-xfh8-5m86-f927
-
Chainguard
CGA-xg9p-8q2g-853v
-
Chainguard
CGA-xm85-63gp-fj3m
-
Chainguard
CGA-xqcx-h4rg-36x7
-
Chainguard
CGA-xr58-94q7-97jf
-
Chainguard
CGA-xrwp-jgqc-qjpm
-
Chainguard
CGA-xw6x-ghqr-pj84
-
Chainguard
CGA-xx82-wm4j-j4mv
-
Chainguard
CGA-xxfp-hhj7-cgfg
-
minimos
MINI-2rhr-fm88-hfqf
-
minimos
MINI-38vx-q2f3-px54
-
minimos
MINI-3gpf-933p-v7g3
-
minimos
MINI-4x8f-8wc3-ghwg
-
minimos
MINI-5jjc-jh3c-jwmj
-
minimos
MINI-6gfp-pjgg-96qx
-
minimos
MINI-77c3-mc2j-7hqc
-
minimos
MINI-7f86-q2f5-635g
-
minimos
MINI-8mw5-3rj5-hgw9
-
minimos
MINI-8vc3-j8w7-rgcv
-
minimos
MINI-9453-hj5h-pjxx
-
minimos
MINI-9644-x5gq-6w4f
-
minimos
MINI-9729-f4r5-7hhv
-
minimos
MINI-986q-2674-hqc8
-
minimos
MINI-ccfh-7255-67xp
-
minimos
MINI-h2c8-qrhw-q5c9
-
minimos
MINI-h79h-ggfv-q7ph
-
minimos
MINI-j2g4-9mf7-37v6
-
minimos
MINI-j4c8-hmmv-8qx5
-
minimos
MINI-j4r5-9jwf-x4fw
-
minimos
MINI-pp63-7g7r-322q
-
minimos
MINI-qjv7-pw7q-9xv2
-
minimos
MINI-r7hv-mpr8-pp2w
-
minimos
MINI-v75j-2m69-g23p
-
minimos
MINI-vhg4-q299-qcr2
-
minimos
MINI-vxf9-r72w-c9hf
-
minimos
MINI-wv7q-xr93-hqqq
-
minimos
MINI-xhhw-pp63-jmw5
-
minimos
MINI-xvp2-792x-q38p
-