CVE-2021-21270: Cleartext Storage of Sensitive Information

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-01-22 · updated 2026-06-17
Weakness: CWE-319

Description

OctopusDSC is a PowerShell module with DSC resources that can be used to install and configure an Octopus Deploy Server and Tentacle agent. In OctopusDSC version 4.0.977 and earlier a customer API key used to connect to Octopus Server is exposed via logging in plaintext. This vulnerability is patched in version 4.0.1002.

Affected products

OctopusDeploy OctopusDSC: before 4.0.1002 — fixed in 4.0.1002

How to fix

Upgrade to a fixed version: OctopusDeploy OctopusDSC 4.0.1002. Check the vendor advisory for mitigations.

References

https://github.com/OctopusDeploy/OctopusDSC/commit/24b448e6ac964ed938475add494a145c0473ac42
https://github.com/OctopusDeploy/OctopusDSC/pull/270
https://github.com/OctopusDeploy/OctopusDSC/releases/tag/v4.0.1002
https://github.com/OctopusDeploy/OctopusDSC/security/advisories/GHSA-phmm-rfg9-94fm
https://github.com/OctopusDeploy/OctopusDSC/commit/24b448e6ac964ed938475add494a145c0473ac42
https://github.com/OctopusDeploy/OctopusDSC/pull/270
https://github.com/OctopusDeploy/OctopusDSC/releases/tag/v4.0.1002
https://github.com/OctopusDeploy/OctopusDSC/security/advisories/GHSA-phmm-rfg9-94fm

Get alerted when CVE-2021-21270 or the next vulnerability affects your stack