Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
3 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
hubuumclient diagnostics can expose sensitive request, response, import/export, task, delivery, or server-provided data when applications format or log errors and public models. Affected behavior Native reqwest::Error values retain the full request URL. Converting those errors into ApiError::Http, or exhausting retries and storing the error text in ApiError::RetryExhausted, preserves query parameter values. Detailed HTTP and decoding errors can retain server-provided messages, response bodies, or payload details, including through error source chains. Several public response and model types also derived or implemented diagnostics over untrusted or secret-adjacent fields. These include raw response bodies and cursors; rendered and JSON export payloads; import schemas and object data; task summaries, links, output URLs, events, and import-result details; event-delivery claims and errors; event sink configuration; subscription routing; and remote-call failure details. High-level…
Recommended action: Upgrade to 0.6.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
When an application configures hubuumclient with ClientBuilder::withtransport, several client operations still use the built-in reqwest client directly. The bypass includes password login, bearer-token validation, authentication-provider discovery, health and readiness probes, export-output downloads, and unified-search streams. Impact Applications may use a custom transport as a security boundary for network isolation, proxy enforcement, request signing, audit logging, or policy checks. Affected operations bypass those controls and make direct network requests to the configured base URL. Password login can therefore send plaintext credentials outside the intended transport, while token validation can send a bearer token outside it. Other bypassing calls can evade audit and routing policy. The issue affects custom transports introduced in 0.3.0. Applications that do not configure a custom transport are not affected by the bypass. Defense in depth The same private fix disables…
Recommended action: Upgrade to 0.6.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The built-in async and blocking clients used reqwest's default redirect policy. BaseUrl constrains the initial request to the configured origin and path prefix, but redirect processing occurs after that validation. reqwest retains sensitive headers when a redirect changes only the path on the same scheme, host, and port. A redirect from a Hubuum endpoint to another path on a shared origin could therefore carry the bearer Authorization header outside the configured Hubuum path prefix. Exploitation requires an attacker, compromised server, or intermediary to influence a 3xx response. Cross-origin redirects are not affected because reqwest strips sensitive headers when scheme, host, or port changes. Patches Version 0.6.1 configures both built-in HTTP clients with reqwest::redirect::Policy::none(). Redirect responses are returned as 3xx API errors instead of being followed. Supplying a preconfigured reqwest client remains an explicit opt-in to that client's redirect policy.…
Recommended action: Upgrade to 0.6.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.