please update vault/api/go.mod to use go-viper/mapstructure/v2.4.0 instead of mitchellh/mapstructure v1.5.0

[jarekchr]

GHSA-2464-8j7c-4cjm is reported for mapstructure.
In main go.mod there's go-viper/mapstructure used but in vault/api/go.mod there's mitchellh/mapstructure v1.5.0 that is archived.
Also https://github.com/mitchellh/go-homedir project is archived too.
Please update them and possibly other dependencies.

Thanks and regards,
Jarek

[cipherboy]

GHSA-fv92-fjc5-jj9h is a second version of this as well that I reported and have fixed in OpenBao with the patched mapstructure (thanks Mark!).

https://discuss.hashicorp.com/t/hcsec-2025-09-vault-may-expose-sensitive-information-in-error-logs-when-processing-malformed-data-with-the-kv-v2-plugin/74717/1 was much broader than reported.

Rather than just the reported:

[ERROR] core: failed to run existence check: error="error converting input <secret data> for field \"data\": '' expected a map, got 'string'"

You could also get errors like:

[ERROR] core: failed to run existence check: error="error converting input <secret data> for field \"data\": '' <secret data in the mapstructure error>"

for example, when passing sensitive (string) data to an int field. This affected many more endpoints than just KVv2.

[heatherezell]

Hi @jarekchr! Please email security@hashicorp.com with this information for a faster turnaround time. You can reference this GitHub issue ID when doing so. Thanks! :)

[jarekchr]

HI @heatherezell. OK - I did.