CVE-2021-32074

HashiCorp vault-action (aka Vault GitHub Action) before 2.2.0 allows attackers to obtain sensitive information from log files because a multi-line secret was not correctly registered with GitHub Actions for log masking.

• CWE-532

• https://discuss.hashicorp.com/t/hcsec-2021-13-vault-github-action-did-not-correctly-mask-multi-line-secrets-in-output/24128Vendor Advisory
• https://github.com/hashicorp/vault-action/blob/master/CHANGELOG.mdThird Party Advisory
• https://github.com/hashicorp/vault-action/issues/205Exploit, Third Party Advisory
• https://github.com/hashicorp/vault-action/pull/208Patch, Third Party Advisory
• https://discuss.hashicorp.com/t/hcsec-2021-13-vault-github-action-did-not-correctly-mask-multi-line-secrets-in-output/24128Vendor Advisory
• https://github.com/hashicorp/vault-action/blob/master/CHANGELOG.mdThird Party Advisory
• https://github.com/hashicorp/vault-action/issues/205Exploit, Third Party Advisory
• https://github.com/hashicorp/vault-action/pull/208Patch, Third Party Advisory

Published

May 7, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-32068The AWV and MiCollab Client Service components in Mitel MiCo…3.7
• CVE-2021-32069The AWV component of Mitel MiCollab before 9.3 could allow a…4.8
• CVE-2021-32070The MiCollab Client Service component in Mitel MiCollab befo…5.4
• CVE-2021-32071The MiCollab Client service in Mitel MiCollab before 9.3 cou…9.8
• CVE-2021-32072The MiCollab Client Service component in Mitel MiCollab befo…6.5
• CVE-2021-32073DedeCMS V5.7 SP2 contains a CSRF vulnerability that allows a…8.8
• CVE-2021-32075Re-Logic Terraria before 1.4.2.3 performs Insecure Deseriali…9.8
• CVE-2021-32076Access Restriction Bypass via referrer spoof was discovered …5.3
• CVE-2021-32077Primary Source Verification in VerityStream MSOW Solutions b…7.5
• CVE-2021-32078An Out-of-Bounds Read was discovered in arch/arm/mach-footbr…7.1
• CVE-2021-32084An issue was discovered in Quest KACE Systems Deployment App…9.8
• CVE-2021-32085An issue was discovered in Quest KACE Systems Deployment App…8.8