# GHSA-2625-rw7m-5q5x: Hubuum client library (Rust): Sensitive data may be exposed through default diagnostics

> Attackers can access sensitive data like tokens and payloads via logs because the Hubuum client library exposes them in default error diagnostics.

- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Over the internet
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 24 Jul 2026

## What is GHSA-2625-rw7m-5q5x?

GHSA-2625-rw7m-5q5x is a vulnerability in hubuum_client, published on 24 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

### Official description

## Summary

`hubuum_client` diagnostics can expose sensitive request, response, import/export, task, delivery, or server-provided data when applications format or log errors and public models.

## Affected behavior

Native `reqwest::Error` values retain the full request URL. Converting those errors into `ApiError::Http`, or exhausting retries and storing the error text in `ApiError::RetryExhausted`, preserves query parameter values. Detailed HTTP and decoding errors can retain server-provided messages, response bodies, or payload details, including through error source chains.

Several public response and model types also derived or implemented diagnostics over untrusted or secret-adjacent fields. These include raw response bodies and cursors; rendered and JSON export payloads; import schemas and object data; task summaries, links, output URLs, events, and import-result details; event-delivery claims and errors; event sink configuration; subscription routing; and remote-call failure details. High-level backup and export runners additionally copied unsuccessful server task summaries into `ApiError::Api`.

Applications commonly log errors and response values, so credentials, tokens, cursors, filters, echoed request content, imported object data, schema defaults, task or delivery details, and other sensitive payloads can be written to logs even though normal request logging redacts query values.

## Remediation

The proposed fix redacts query values from embedded request URLs before storing native HTTP errors and applies the same sanitization to exhausted retries. Default error and model diagnostics now report safe metadata rather than server messages, payloads, cursors, links, configuration, or secret-adjacent details. JSON codec errors no longer appear in the standard source chain, and unsuccessful high-level backup/export operations use the structured `TaskUnsuccessful` variant without copying task summaries.

Explicit response, error, task, import, export, event, and delivery APIs continue to expose original values for applications that deliberately inspect them.

## Validation

Regression coverage exercises direct HTTP conversion, async and blocking retry exhaustion, response and decoding diagnostics, import/export/raw-response containers, unsuccessful async and blocking task runners, task/event/import-result models, and secret-bearing event and remote models. The workspace format, lint, documentation, test, feature-matrix, Rust 1.88 MSRV, OpenAPI validation, release-metadata, and combined library plus consumer integration suites pass against the immutable Hubuum 0.0.3 image.

## Which versions are affected by GHSA-2625-rw7m-5q5x?

2 open source packages ship an affected version, including hubuum_client.


| Package | Ecosystem | Affected | Fixed in |
| --- | --- | --- | --- |
| `hubuum_client` | crates.io | All versions | 0.6.1 |
| `hubuum_client` | crates.io | All versions | 0.6.1 |

## How do I fix GHSA-2625-rw7m-5q5x?

Upgrade hubuum_client to 0.6.1 or later.

## Is GHSA-2625-rw7m-5q5x being exploited?

There is no known exploitation of GHSA-2625-rw7m-5q5x in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for GHSA-2625-rw7m-5q5x and fix it if it is affected.

What it is: GHSA-2625-rw7m-5q5x is a vulnerability in hubuum_client, published on 24 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Exploitation: There is no known exploitation of GHSA-2625-rw7m-5q5x in the wild and no public exploit code.

Affected packages and fixed versions:
- hubuum_client (crates.io): affected all versions; fixed in 0.6.1
- hubuum_client (crates.io): affected all versions; fixed in 0.6.1

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/GHSA-2625-rw7m-5q5x/ (Markdown: https://insights.sbomify.com/GHSA-2625-rw7m-5q5x/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/GHSA-2625-rw7m-5q5x

---
From sbomify Insights: https://insights.sbomify.com/GHSA-2625-rw7m-5q5x/
Summaries are generated and may contain mistakes; the official description above is the record.