GHSA-c8m5-c952-6cm4: OpenAI Node Debug on client

Q: Is GHSA-c8m5-c952-6cm4 actively exploited?

No confirmed active exploitation of GHSA-c8m5-c952-6cm4 has been reported, but organizations should still patch proactively.

Q: How to fix GHSA-c8m5-c952-6cm4?

1. Upgrade rustls to 0.23.46 or later (cargo update -p rustls) and rebuild and redeploy binaries. 2. Review any custom ClientSessionStore implementations for Debug formatting (for example {:?} or dbg!) of Tls12ClientSessionValue and Tls13ClientSessionValue. 3. Search existing logs and log pipelines for session-value dumps, restrict access to them and purge them where feasible. 4. If leakage is suspected, rotate credentials sent over affected sessions and consider disabling session resumption temporarily. 5. Use cargo audit or the RUSTSEC-2026-0346 advisory in CI to detect vulnerable versions.

Q: What systems are affected by GHSA-c8m5-c952-6cm4?

This vulnerability affects the following AI/ML architecture patterns: LLM API clients, model serving gateways, agent frameworks, vector database clients.

Q: What is the CVSS score for GHSA-c8m5-c952-6cm4?

GHSA-c8m5-c952-6cm4 has a CVSS v3.1 base score of 4.0 (MEDIUM).

CISO Take

rustls, the widely used Rust TLS library, had a flaw where formatting a client session value with Debug exposed the TLS 1.2 master secret or TLS 1.3 resumption PSK. This only matters if a custom ClientSessionStore implementation logs these values, since built-in cache and connection diagnostics stay redacted. With 1,762 downstream dependents the potential footprint is broad, but the risk is low: it needs local access, a high-privilege reader of the logs and a non-default logging pattern. There is no KEV listing, no public exploit, no Nuclei template and no EPSS data, so exploitation likelihood is minimal. Upgrade to rustls 0.23.46 and audit logs for leaked session material if you use a custom session store, especially in Rust-based LLM API clients and inference gateways.

Sources:GitHub AdvisoryRustSecATLAS

What is the risk?

Low-to-medium risk. CVSS 4.0 (AV:L/AC:H/PR:H/UI:R) reflects local access, high complexity and high privileges, with confidentiality impact only. Exploitation requires a custom ClientSessionStore that formats session values with Debug and writes them to logs an attacker can read. There is no known exploitation, public exploit or scanner template. Exposure is greatest where verbose or debug logging is shipped to shared log platforms with broad read access.

How does the attack unfold?

Initial Access

Attacker gains read access to application logs that contain Debug output from a custom session store.

AML.T0055

Credential Collection

Attacker extracts the TLS 1.2 master secret or TLS 1.3 resumption PSK from the logged session values.

AML.T0055

Impact

With captured traffic, the attacker decrypts the session and exposes prompts, completions and API credentials sent to the LLM service.

AML.T0025

Initial Access

Attacker gains read access to application logs that contain Debug output from a custom session store.

AML.T0055

Credential Collection

Attacker extracts the TLS 1.2 master secret or TLS 1.3 resumption PSK from the logged session values.

AML.T0055

Impact

With captured traffic, the attacker decrypts the session and exposes prompts, completions and API credentials sent to the LLM service.

AML.T0025

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenAI Node	cargo	< 0.23.46	`0.23.46`
11.2K1.8K dependentsPushed 7d ago56% patched~139d to patchFull package profile →

Do you use OpenAI Node? You're affected.

How severe is it?

CVSS 3.1

4.0 / 10

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

Advanced

What is the attack surface?

AVLocal

ACHigh

PRHigh

UIRequired

SUnchanged

CHigh

INone

ANone

What should I do?

5 steps

Upgrade rustls to 0.23.46 or later (cargo update -p rustls) and rebuild and redeploy binaries.
Review any custom ClientSessionStore implementations for Debug formatting (for example {:?} or dbg!) of Tls12ClientSessionValue and Tls13ClientSessionValue.
Search existing logs and log pipelines for session-value dumps, restrict access to them and purge them where feasible.
If leakage is suspected, rotate credentials sent over affected sessions and consider disabling session resumption temporarily.
Use cargo audit or the RUSTSEC-2026-0346 advisory in CI to detect vulnerable versions.

How is it classified?

Data LeakageAPIFrameworkAML.T0055- Unsecured Credentials

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.7.4-Quality of data for AI systems

NIST AI RMF

MANAGE 2.3-Risk treatment and response to identified risks

OWASP LLM Top 10

LLM03-Supply Chain

Frequently Asked Questions

What is GHSA-c8m5-c952-6cm4?

rustls, the widely used Rust TLS library, had a flaw where formatting a client session value with Debug exposed the TLS 1.2 master secret or TLS 1.3 resumption PSK. This only matters if a custom ClientSessionStore implementation logs these values, since built-in cache and connection diagnostics stay redacted. With 1,762 downstream dependents the potential footprint is broad, but the risk is low: it needs local access, a high-privilege reader of the logs and a non-default logging pattern. There is no KEV listing, no public exploit, no Nuclei template and no EPSS data, so exploitation likelihood is minimal. Upgrade to rustls 0.23.46 and audit logs for leaked session material if you use a custom session store, especially in Rust-based LLM API clients and inference gateways.

Is GHSA-c8m5-c952-6cm4 actively exploited?

No confirmed active exploitation of GHSA-c8m5-c952-6cm4 has been reported, but organizations should still patch proactively.

How to fix GHSA-c8m5-c952-6cm4?

1. Upgrade rustls to 0.23.46 or later (cargo update -p rustls) and rebuild and redeploy binaries. 2. Review any custom ClientSessionStore implementations for Debug formatting (for example {:?} or dbg!) of Tls12ClientSessionValue and Tls13ClientSessionValue. 3. Search existing logs and log pipelines for session-value dumps, restrict access to them and purge them where feasible. 4. If leakage is suspected, rotate credentials sent over affected sessions and consider disabling session resumption temporarily. 5. Use cargo audit or the RUSTSEC-2026-0346 advisory in CI to detect vulnerable versions.

What systems are affected by GHSA-c8m5-c952-6cm4?

This vulnerability affects the following AI/ML architecture patterns: LLM API clients, model serving gateways, agent frameworks, vector database clients.

What is the CVSS score for GHSA-c8m5-c952-6cm4?

GHSA-c8m5-c952-6cm4 has a CVSS v3.1 base score of 4.0 (MEDIUM).

What is the AI security impact?

Affected AI Architectures

LLM API clientsmodel serving gatewaysagent frameworksvector database clients

MITRE ATLAS Techniques

AML.T0055Unsecured Credentials

Compliance Controls Affected

ISO 42001: A.7.4

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

### Summary Formatting a client session value with Debug exposes its TLS 1.2 master secret or TLS 1.3 resumption PSK. A custom session store that logs these values can disclose keys to readers of the logs. Ordinary connection and built-in cache diagnostics remain redacted, and the session-store interface already warns that its values are sensitive. ### Details Derived formatters traverse the session's secret-bearing fields. This conflicts with the project's explicit [key-material redaction policy](https://github.com/rustls/rustls/blob/99f2358cae2954837dbb866faf6727de75489ab9/SECURITY.md#boundary-public-api). ### Proof of concept Custom `ClientSessionStore` implementations could leak secret data by using the provided `Tls12ClientSessionValue` or `Tls13ClientSessionValue` in a way that triggers its implementation of the `Debug` trait. ### Impact Such store implementations could leak the master secret for the TLS connection. ### Acknowledgement Thanks to OpenAI [OutboundDisclosures@openai.com](mailto:OutboundDisclosures@openai.com) for the disclosure.

Exploitation Scenario

An organization runs a Rust-based LLM gateway with a custom ClientSessionStore that logs session values at debug level for troubleshooting. The logs are shipped to a centralized platform readable by many engineers and contractors. An insider or an attacker who has compromised the log platform extracts a TLS 1.3 resumption PSK or TLS 1.2 master secret. Combined with a network position that captures traffic to the upstream LLM API, they decrypt the session and recover prompts, responses and bearer tokens.

Weaknesses (CWE)

CWE-212Improper Removal of Sensitive Information Before Storage or TransferPrimary

CWE-212 — Improper Removal of Sensitive Information Before Storage or Transfer: The product stores, transfers, or shares a resource that contains sensitive information, but it does not properly remove that information before the product makes the resource available to unauthorized actors.

[Requirements] Clearly specify which information should be regarded as private or sensitive, and require that the product offers functionality that allows the user to cleanse the sensitive information from the resource before it is published or exported to other parties.
[Architecture and Design] Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.

Source: MITRE CWE corpus.