{"id":"GHSA-g35x-j6jj-8g7j","aliases":[],"status":"published","title":"@mittwald/kubernetes's secret contents leaked via debug logging","description":"### Impact\n\nWhen debug logging is enabled (via `DEBUG` environment variable), the Kubernetes client may log all response bodies into the debug log -- including sensitive data from `Secret` resources.\n\nWhen running in a Kubernetes cluster, this might expose sensitive information to users who are _not_ authorised to access secrets, but have access to Pod logs (either directly using kubectl, or by Pod logs being shipped elsewhere).\n\n### Patches\nUpgrade to 3.5.0 or newer.\n\n### Workarounds\nDisable debug logging entirely, or exclude the `kubernetes:client` debug item (for example, using `DEBUG=*,-kubernetes:client`).\n\n### References\n\n- https://cwe.mitre.org/data/definitions/532.html","severity":{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-532"],"published":"2023-05-02T16:51:25Z","modified":"2023-05-02T16:51:26Z","fixes":[{"ecosystem":"npm","package":"@mittwald/kubernetes","fixed_in":["3.5.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"@mittwald/kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0"}]}]},{"source":"osv","ecosystem":"npm","package":"@mittwald/kubernetes","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.5.0"}]}]}],"references":[{"url":"https://github.com/mittwald/node-kubernetes/security/advisories/GHSA-g35x-j6jj-8g7j","tags":["web"]},{"url":"https://github.com/mittwald/node-kubernetes/commit/04f6809fd438417c343d541e57f76f0040e069cd","tags":["web"]},{"url":"https://github.com/mittwald/node-kubernetes/releases/tag/v3.5.0","tags":["web"]},{"url":"https://github.com/advisories/GHSA-g35x-j6jj-8g7j"},{"url":"https://github.com/mittwald/node-kubernetes","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-g35x-j6jj-8g7j","title":"@mittwald/kubernetes's secret contents leaked via debug logging","description":"### Impact\n\nWhen debug logging is enabled (via `DEBUG` environment variable), the Kubernetes client may log all response bodies into the debug log -- including sensitive data from `Secret` resources.\n\nWhen running in a Kubernetes cluster, this might expose sensitive information to users who are _not_ authorised to access secrets, but have access to Pod logs (either directly using kubectl, or by Pod logs being shipped elsewhere).\n\n### Patches\nUpgrade to 3.5.0 or newer.\n\n### Workarounds\nDisable debug logging entirely, or exclude the `kubernetes:client` debug item (for example, using `DEBUG=*,-kubernetes:client`).\n\n### References\n\n- https://cwe.mitre.org/data/definitions/532.html\n","status":"published","published":"2023-05-02T16:51:25Z","modified":"2023-05-02T16:51:26Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T14:36:52.310293Z"}],"osv":[{"id":"GHSA-g35x-j6jj-8g7j","title":"@mittwald/kubernetes's secret contents leaked via debug logging","description":"### Impact\n\nWhen debug logging is enabled (via `DEBUG` environment variable), the Kubernetes client may log all response bodies into the debug log -- including sensitive data from `Secret` resources.\n\nWhen running in a Kubernetes cluster, this might expose sensitive information to users who are _not_ authorised to access secrets, but have access to Pod logs (either directly using kubectl, or by Pod logs being shipped elsewhere).\n\n### Patches\nUpgrade to 3.5.0 or newer.\n\n### Workarounds\nDisable debug logging entirely, or exclude the `kubernetes:client` debug item (for example, using `DEBUG=*,-kubernetes:client`).\n\n### References\n\n- https://cwe.mitre.org/data/definitions/532.html\n","status":"published","published":"2023-05-02T16:51:25Z","modified":"2023-05-02T16:51:25Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T15:46:47.119724Z"}]}}