The vulnerability in hubuum_client (Rust) involves the exposure of sensitive data through default diagnostic outputs. Native reqwest::Error values retain full request URLs including query parameters, which are preserved when converted into ApiError variants. Diagnostic implementations on various public response and model types include untrusted or secret-adjacent fields such as raw response bodies, import/export data, task summaries, event details, and configuration. As applications often log these diagnostics, sensitive information can be inadvertently exposed. The remediation involves redacting query parameters from URLs in errors, sanitizing diagnostic outputs to exclude sensitive data, and modifying error handling to avoid including detailed server messages or payloads in default diagnostics.

Sensitive information including credentials, tokens, query parameters, server response bodies, and other secret-adjacent data may be exposed in application logs or error outputs. This exposure could lead to information disclosure risks if logs are accessed by unauthorized parties. The severity is considered low based on the available data and CVSS 4.0 vector indicating network attack vector, low complexity, and limited privileges required.

A fix is available that redacts query parameter values from embedded request URLs before storing HTTP errors and applies similar sanitization to retry exhaustion errors. Default error and model diagnostics have been updated to report only safe metadata, excluding server messages, payloads, cursors, links, configuration, or secret-adjacent details. Applications that require access to original values can still explicitly use response, error, task, import, export, event, and delivery APIs. Users should upgrade to version 0.6.1 or later to benefit from these fixes.