kube-audit-rest's example logging configuration could disclose secret values in the audit log in github.com/RichardoC/kube-audit-rest

Open Source Vulnerabilities GO-2025-3431

kube-audit-rest's example logging configuration could disclose secret values in the audit log in github.com/RichardoC/kube-audit-rest

Open Source Vulnerabilities GHSA-hcr5-wv4p-h2g2

### Impact _What kind of vulnerability is it? Who is impacted?_ If the "full-elastic-stack" example vector configuration was used for a real cluster, the previous values of kubernetes secrets would have been disclosed in the audit messages. ### Patches _Has the problem been patched? What versions should users upgrade to?_ The example has been updated to fix this in commit 9df8886b4819409f566233adc7c3b7a43a4096ba ### Workarounds _Is there a way for users to fix or remediate the vulnerability without upgrading?_ Replace ```yaml if .request.requestKind.kind == "Secret" { del(.request.object.data) .request.object.data.redacted = "REDACTED" del(.request.oldObject.data) .request.oldObject.data.redacted = "REDACTED" } ``` In the vector "audit-files-json-parser-and-redaction" step with ```yaml if .request.requestKind.kind == "Secret" { # Redact the secret data del(.request.object.data) .request.object.data.redacted = "REDACTED" del(.request.oldObject.data) .request.oldObject.data.redacted = "REDACTED" # Remove the previously set secret data - Not bothering to parse it as this annotation shouldn't ever be needed del(.request.object.metadata.annotations.["kubectl.kubernetes.io/last-applied-configuration"]) del(.request.oldObject.metadata.annotations.["kubectl.kubernetes.io/last-applied-configuration"]) } ``` ### References _Are there any links users can visit to find out more?_

Open Source Vulnerabilities CVE-2025-24884

kube-audit-rest is a simple logger of mutation/creation requests to the k8s api. If the "full-elastic-stack" example vector configuration was used for a real cluster, the previous values of kubernetes secrets would have been disclosed in the audit messages. This vulnerability is fixed in 1.0.16.