{"id":"CVE-2021-32074","aliases":["EUVD-2022-2409","GHSA-4mgv-m5cm-f9h7"],"status":"published","title":"Vault GitHub Action did not correctly mask multi-line secrets in output","description":"HashiCorp vault-action (aka Vault GitHub Action) before 2.2.0 allows attackers to obtain sensitive information from log files because a multi-line secret was not correctly registered with GitHub Actions for log masking.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.0188,"percentile":0.79606,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-532"],"published":"2021-05-07T04:01:29Z","modified":"2026-10-20T10:54:41Z","fixes":[{"ecosystem":"GitHub Actions","package":"hashicorp/vault-action","fixed_in":["2.2.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"GitHub Actions","package":"hashicorp/vault-action","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.0"}]}]},{"source":"osv","ecosystem":"GitHub Actions","package":"hashicorp/vault-action","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.0"}]}]}],"products":[{"vendor":"hashicorp","product":"vault-action"}],"references":[{"url":"https://github.com/hashicorp/vault-action/blob/master/CHANGELOG.md","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://github.com/hashicorp/vault-action/pull/208","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://github.com/hashicorp/vault-action/issues/205","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","web"]},{"url":"https://discuss.hashicorp.com/t/hcsec-2021-13-vault-github-action-did-not-correctly-mask-multi-line-secrets-in-output/24128","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-32074","tags":["advisory"]},{"url":"https://github.com/hashicorp/vault-action/commit/3526e1be65cf8faf42d6088bc5da8bff596c718a","tags":["web"]},{"url":"https://github.com/advisories/GHSA-4mgv-m5cm-f9h7"},{"url":"https://github.com/hashicorp/vault-action","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2021-32074","description":"HashiCorp vault-action (aka Vault GitHub Action) before 2.2.0 allows attackers to obtain sensitive information from log files because a multi-line secret was not correctly registered with GitHub Actions for log masking.","status":"published","published":"2021-05-07T04:01:29Z","modified":"2024-08-03T23:17:28.925Z","updated_at":"2026-11-02T14:33:07.014772Z"}],"euvd":[{"id":"EUVD-2022-2409","description":"HashiCorp vault-action (aka Vault GitHub Action) before 2.2.0 allows attackers to obtain sensitive information from log files because a multi-line secret was not correctly registered with GitHub Actions for log masking.","status":"published","published":"2021-05-07T04:01:29Z","modified":"2024-08-03T23:17:28Z","updated_at":"2026-11-03T03:24:37.407491Z"}],"ghsa":[{"id":"GHSA-4mgv-m5cm-f9h7","title":"Vault GitHub Action did not correctly mask multi-line secrets in output","description":"HashiCorp vault-action (aka Vault GitHub Action) before 2.2.0 allows attackers to obtain sensitive information from log files because a multi-line secret was not correctly registered with GitHub Actions for log masking.\n\nThe vault-action implementation did not correctly handle the marking of multi-line variables. As a result, multi-line secrets were not correctly masked in vault-action output.\n\nRemediation:\nCustomers using vault-action should evaluate the risk associated with this issue, and consider upgrading to vault-action 2.2.0 or newer. Please refer to https://github.com/marketplace/actions/hashicorp-vault for more information.","status":"published","published":"2022-05-24T19:01:50Z","modified":"2024-01-25T19:58:48Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T14:37:32.302254Z"}],"nvd":[{"id":"CVE-2021-32074","description":"HashiCorp vault-action (aka Vault GitHub Action) before 2.2.0 allows attackers to obtain sensitive information from log files because a multi-line secret was not correctly registered with GitHub Actions for log masking.","status":"published","published":"2021-05-07T05:15:08.153Z","modified":"2026-06-17T03:52:45.423Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T14:06:52.81233Z"}],"osv":[{"id":"CVE-2021-32074","description":"HashiCorp vault-action (aka Vault GitHub Action) before 2.2.0 allows attackers to obtain sensitive information from log files because a multi-line secret was not correctly registered with GitHub Actions for log masking.","status":"published","published":"2021-05-07T05:15:08.153Z","modified":"2026-10-20T10:54:41.649075215Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:19.793849Z"},{"id":"GHSA-4mgv-m5cm-f9h7","title":"Vault GitHub Action did not correctly mask multi-line secrets in output","description":"HashiCorp vault-action (aka Vault GitHub Action) before 2.2.0 allows attackers to obtain sensitive information from log files because a multi-line secret was not correctly registered with GitHub Actions for log masking.\n\nThe vault-action implementation did not correctly handle the marking of multi-line variables. As a result, multi-line secrets were not correctly masked in vault-action output.\n\nRemediation:\nCustomers using vault-action should evaluate the risk associated with this issue, and consider upgrading to vault-action 2.2.0 or newer. Please refer to https://github.com/marketplace/actions/hashicorp-vault for more information.","status":"published","published":"2022-05-24T19:01:50Z","modified":"2024-01-25T19:58:46Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T15:46:37.148947Z"}]}}