CVE-2023-34097 Database password exposed in logs in hoppscotch
Attackers with log access can read database passwords, leading to full database access and privilege escalation in Hoppscotch.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-34097?
CVE-2023-34097 is a high-severity vulnerability in hoppscotch, published on 5 Jun 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
hoppscotch is an open source API development ecosystem. In versions prior to 2023.4.5 the database password is exposed in the logs when showing the database connection string. Attackers with access to read system logs will be able to elevate privilege with full access to the database. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Weakness: CWE-532
Which versions are affected by CVE-2023-34097?
It affects 1 product.
Products include Hoppscotch Hoppscotch.
How do I fix CVE-2023-34097?
No fix has been published for CVE-2023-34097 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-34097 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-34097 exists.
Other vulnerabilities in hoppscotch
- CVE-2026-50160 Mass Assignment via Onboarding Endpoint Allows Unauthenticated JWT_SECRET Overwrite
- CVE-2026-28215 hoppscotch Vulnerable to Unauthenticated Onboarding Config Takeover
- CVE-2026-34931 hoppscotch: Improper loopback redirect_uri validation in device-login flow
- CVE-2026-34932 hoppscotch: Stored XSS via mock server responses on backend origin
- CVE-2026-28216 hoppscotch has IDOR in updateUserEnvironment / deleteUserEnvironment
Sources
Also known as GHSA-qpx8-wq6q-r833.