CVE-2021-38554: Improper Removal of Sensitive Information Before Storage or Transfer in HashiCorp Vault
Summary
CVE-2021-38554: Improper Removal of Sensitive Information Before Storage or Transfer in HashiCorp Vault. Affects github.com/hashicorp/vault across 2 version ranges.
< 1.6.6
>= 1.7.0, < 1.7.4
Fixed in 1.6.6 or 1.7.4, depending on the release line you run. How to fix ↓
Also tracked for
- vault · Bitnami
The same CVE-2021-38554 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
HashiCorp Vault is a popular open-source tool used for securely storing and accessing sensitive data. It provides a centralized solution for managing secrets, encryption keys, and other confidential information. The vulnerability identified as CVE-2021-38554 affects HashiCorp Vault and Vault Enterprise's UI. It involves the improper removal of sensitive information before storage or transfer, leading to the caching and exposure of user-viewed secrets between sessions in a single shared browser.
Vulnerability Detail
The vulnerability arises from the incorrect caching and exposure of secrets in the UI of HashiCorp Vault. When a user views secrets in the UI, the information is cached and accessible to other users in the same shared browser session. This can result in unauthorized access to sensitive data, potentially leading to data breaches or unauthorized disclosure of confidential information. The vulnerability has a CVSS score of 5.3, indicating a moderate severity level.
How To Fix
Latest published version: v1.21.4 as of 23 Oct 2026
go get github.com/hashicorp/vault@v1.21.4Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.6.61.6.6go get github.com/hashicorp/vault@v1.6.6 -
>= 1.7.0, < 1.7.41.7.4go get github.com/hashicorp/vault@v1.7.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can avoid sharing the same browser session for accessing HashiCorp Vault. By using separate browser instances or clearing the cache between sessions, the risk of exposing user-viewed secrets can be reduced. However, this is not a permanent solution, and updating to the fixed versions is strongly recommended.
Conclusion
In conclusion, the vulnerability in HashiCorp Vault (CVE-2021-38554) exposes user-viewed secrets due to improper removal of sensitive information before storage or transfer. This can lead to unauthorized access to confidential data and potential data breaches. To mitigate the risk, it is crucial to update to the fixed versions of HashiCorp Vault (1.8.0, 1.7.4, or 1.6.6). For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/hashicorp/vault →
FAQ
HashiCorp Vault is an open-source tool used for securely storing and accessing sensitive data, such as passwords, API keys, and encryption keys. It provides a centralized solution for managing secrets and offers various authentication and authorization mechanisms.
The vulnerability allows for the caching and exposure of user-viewed secrets between sessions in a shared browser. This can lead to unauthorized access to sensitive information and potential data breaches.
The vulnerability has a CVSS score of 5.3, indicating a moderate severity level.
To fix the vulnerability, it is recommended to update to the latest version of HashiCorp Vault. The issue has been addressed in version 1.8.0. For users on older versions, patches are pending and will be released in versions 1.7.4 and 1.6.6.
As a temporary workaround, users can avoid sharing the same browser session for accessing HashiCorp Vault. By using separate browser instances or clearing the cache between sessions, the risk of exposing user-viewed secrets can be reduced. However, updating to the fixed versions is strongly recommended.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/hashicorp/vault.
