CVE-2023-34097: Database password exposed in logs in hoppscotch

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-06-05 · updated 2026-06-17
Weakness: CWE-532

Description

hoppscotch is an open source API development ecosystem. In versions prior to 2023.4.5 the database password is exposed in the logs when showing the database connection string. Attackers with access to read system logs will be able to elevate privilege with full access to the database. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected products

hoppscotch: before 2023.4.5 — fixed in 2023.4.5

How to fix

Upgrade to a fixed version: hoppscotch 2023.4.5. Check the vendor advisory for mitigations.

References

https://github.com/hoppscotch/hoppscotch/commit/15424903ede20b155d764abf4c4f7c2c84c11247
https://github.com/hoppscotch/hoppscotch/security/advisories/GHSA-qpx8-wq6q-r833
https://github.com/hoppscotch/hoppscotch/commit/15424903ede20b155d764abf4c4f7c2c84c11247
https://github.com/hoppscotch/hoppscotch/security/advisories/GHSA-qpx8-wq6q-r833

Get alerted when CVE-2023-34097 or the next vulnerability affects your stack