CVE-2021-21361

Sensitive information disclosure via log in com.bmuschko:gradle-vagrant-plugin

5.3 MediumFix available

The com.bmuschko:gradle-vagrant-plugin Gradle plugin contains an information disclosure vulnerability due to the logging of the system environment variables. When this Gradle plugin is executed in public CI/CD, this can lead to sensitive credentials being exposed to malicious actors. This is fixed in version 3.0.0.

Attack profile

How easy it is to exploit

Attack vector: Physical
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

1.18%Up 0.1 points since Apr 14, 2021

What each source reports

CVE List Score used 5.3

Sensitive information disclosure via log in com.bmuschko:gradle-vagrant-plugin

Record: CVE-2021-21361
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Weakness: CWE-532
Updated: 2026-11-02

EUVDEUVD-2021-0678 5.3

Record: EUVD-2021-0678
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated: 2026-11-03

GitHub AdvisoriesGHSA-jpcm-4485-69p7 7.4

Sensitive information disclosure via log in com.bmuschko:gradle-vagrant-plugin

Impact

The com.bmuschko:gradle-vagrant-plugin Gradle plugin contains an information disclosure vulnerability due to the logging of the system environment variables.

When this Gradle plugin is executed in public CI/CD, this can lead to sensitive credentials being exposed to malicious actors.

Patches

Fixed in version 3.0.0

References

For more information

If you have any questions or comments about this advisory:

Open an issue in bmuschko/gradle-vagrant-plugin

Record: GHSA-jpcm-4485-69p7
CVSS 3.1: 7.4 HighCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Weakness: CWE-532
Updated: 2026-11-02

NVD 5.3

Record: CVE-2021-21361
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0: 3.3 LowAV:A/AC:L/Au:N/C:P/I:N/A:N
Weakness: CWE-532
Updated: 2026-11-02

OSV 6.5

Record: CVE-2021-21361
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVGHSA-jpcm-4485-69p7 7.4

Sensitive information disclosure via log in com.bmuschko:gradle-vagrant-plugin

Impact

The com.bmuschko:gradle-vagrant-plugin Gradle plugin contains an information disclosure vulnerability due to the logging of the system environment variables.

When this Gradle plugin is executed in public CI/CD, this can lead to sensitive credentials being exposed to malicious actors.

Patches

Fixed in version 3.0.0

References

For more information

If you have any questions or comments about this advisory:

Open an issue in bmuschko/gradle-vagrant-plugin

Record: GHSA-jpcm-4485-69p7
CVSS 3.1: 7.4 HighCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Weakness: CWE-532
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`com.bmuschko:gradle-vagrant-plugin` Maven	0.6 up to 3.0.0	3.0.0
`com.bmuschko:gradle-vagrant-plugin` Maven	0.6 up to 3.0.0, plus listed versions 2.02.12.22.2.1	3.0.0

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-21361 is a medium vulnerability (CVSS 5.3) in Vagrant Project Vagrant, published March 9, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.18%, the 67th percentile. Fixed in com.bmuschko:gradle-vagrant-plugin 3.0.0.