In Spring Vault, an application is vulnerable to insertion of sensitive information into a log file when it attempts to revoke a Vault batch token.

Specifically, an application is vulnerable when all of the following are true:

• The authentication mechanism creates Batch tokens.
• Usage of LifecycleAwareSessionManager in an imperative-only arrangement.
• LifecycleAwareSessionManager.destroy() is called by the application or the application shutdown hook
• The logging level for LifecycleAwareSessionManager or org.springframework.vault.authentication is set at least to WARN or a more detailed logging level.
• The token revocation fails because either of:
  • A vault error response that batch tokens cannot be revoked
  • An I/O error occurs

An application is not vulnerable if any of the following is true:

• The application uses ReactiveSessionManager in a mixed reactive/imperative or reactive-only arrangement.
• LifecycleAwareSessionManager.destroy() is never called by the application or the application shutdown hook
• The logging level for LifecycleAwareSessionManager or org.springframework.vault.authentication is set to ERROR or higher, such as OFF.
• The authentication mechanism creates Service tokens.