CVE-2026-55100 kyndryl-open-source CVE debrief

Who should care

Developers and administrators using hashi-vault-js in their applications, especially those with high security requirements due to the high CVSS score of 8.7, should review and update their dependencies to version 0.5.2 or later. Additionally, security teams and vulnerability management teams should assess the potential impact on their systems and plan accordingly. Monitoring and detection teams should also be aware of potential path traversal and query parameter injection attempts. IT operations and asset inventory management teams may need to coordinate on affected system remediation and compensating controls implementation. Compliance and risk management teams may need to review and update risk assessments and mitigation strategies. Business stakeholders should be informed of the potential security risks and mitigation plans. Product and engineering teams may need to review and update product roadmaps and security features. External partners and suppliers may need to be notified if they are affected by this vulnerability. Security awareness and training teams may need to provide additional training on secure coding practices and vulnerability management. Incident response teams should be prepared to respond to potential security incidents related to this vulnerability. Business continuity and disaster recovery teams may need to review and update their plans to ensure business continuity in case of a security incident. Communications and PR teams may need to develop and implement a communications plan to inform stakeholders about the vulnerability and mitigation plans. Legal and regulatory compliance teams may need to review and ensure compliance with relevant laws and regulations. Audit and assurance teams may need to review and update audit plans to ensure that this vulnerability is properly addressed. The CISO and other senior security leaders should provide strategic guidance and oversight on the mitigation and remediation efforts. The executive team and board of directors should be informed of the potential security risks and mitigation plans, and provide strategic guidance and oversight on the response efforts. The security and IT teams should work with 3

Technical summary

The hashi-vault-js module for Node.js did not properly encode identifier values in Vault request paths and query strings prior to version 0.5.2. This allowed for path traversal and query parameter injection attacks. The issue was fixed in version 0.5.2 by using encodeURIComponent() and URLSearchParams. Affected deployments should prioritize updating to version 0.5.2 or later to mitigate potential attacks.

Defensive priority

Immediate attention recommended due to high CVSS score of 8.7 and potential for path traversal and query parameter injection.

Recommended defensive actions

• Inventory and verify hashi-vault-js versions prior to 0.5.2
• Apply version 0.5.2 or later
• Monitor for potential path traversal and query parameter injection attempts
• Implement compensating controls for affected systems
• Review vendor documentation and security advisories
• Track exceptions and retest remediated assets
• Develop a communications plan for stakeholders

Evidence notes

Evidence from official CVE and NVD sources indicates path traversal and query parameter injection vulnerability in hashi-vault-js prior to version 0.5.2. Limited details on affected scope and vendor remediation. Further review of vendor documentation and security advisories is recommended to understand the full impact and verify affected systems.

Official resources