Rust advisories / matrix-sdk
Vulnerability MediumRUSTSEC-2022-0062 · matrix-sdk
RUSTSEC-2022-0062: matrix-sdk 0.6.0 logs access tokens
Short answerA security vulnerability in the matrix-sdk crate: matrix-sdk 0.6.0 logs access tokens. GitHub rates it Medium. Fixed in 0.6.2: update to a fixed version.
| Crate | matrix-sdk |
|---|---|
| Type | Vulnerability |
| Affected versions | From 0.6.0 before 0.6.2. |
| Fixed in | 0.6.2 |
| Severity | Medium (GitHub rating) |
| Published | 2022-10-24 |
| Last changed | 2023-11-08 |
| Also known as | GHSA-fc4h-xcf3-qj5f |
What to do
- See which version you have:
cargo tree -i matrix-sdk(it also shows which of your dependencies pulls it in). - Update within your version requirement:
cargo update -p matrix-sdk. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for examplematrix-sdk = "0.6.2") or update the dependency that pulls it in. - Check again with
cargo audit, or paste your Cargo.lock into our Cargo.toml checker.
Details from the advisory
When sending Matrix requests using an affected version of matrix-sdk in an application that writes logs using tracing-subscriber (in a way that includes fields of tracing spans such as tracing_subscribers default text output from the fmt module), these logs will contain the user's access token.
References
- Package: crates.io/crates/matrix-sdk
- Advisory: rustsec.org/advisories/RUSTSEC-2022-0062.html
- Report: github.com/matrix-org/matrix-rust-sdk/issues/1110
From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.
Up next
Are you affected?Check your whole dependency treePaste Cargo.lock: every advisory, for your exact versions.Read it next →Also worth your time
Did this answer your question?