UpHeron
All vulnerabilities

Servers and applications

GHSA-7f32-g5xc-mqr7

Vault provider credential exfiltration: echoing the "********" mask restores the stored secret, which is then sent to a caller-controlled endpoint URL

Severity
Medium 6.8
Published
12 Nov 2026
Last changed
12 Nov 2026
Added to UpHeron
12 Nov 2026
Fixed in
0.31.1
Weakness
Insufficiently protected credentials (CWE-522)Server-side request forgery (CWE-918)
Attack
Over the network · Needs an administrator account · No user action needed
Attacker can
Read data
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Sources
Project advisories (GitHub)

Description

A user holding a delegated vaultProvider role can exfiltrate the organization's external secret-store credential (HashiCorp Vault token, Infisical machine-identity client secret, Scaleway secret key) to a server they control.

Vault secrets are write-only by design: the read path replaces them with a mask. That mask is the constant string ****, and the config merge restores the real stored secret whenever an incoming config carries it. The merge validates only that providerType is unchanged — it never validates the endpoint URL, which sits in the same object and is fully caller-controlled. Echo the mask, change the URL, and Dokploy sends the real credential to the attacker's host.

Introduced with the vault subsystem on 2026-08-10, first shipped in v0.30.0. Not covered by any existing advisory.

packages/server/src/services/vault-provider.ts:16 — the mask is a constant:

:28-38 — every read stamps that same constant, so the caller learns it for free:

From Dokploy/dokploy's security advisory. Shortened; the full text is there.

Affected software

SoftwareAffected versions
DokployServers and applications · github:dokploy/dokploy
  • Every version before 0.31.1

References