GET /system/inputs returns encrypted input configuration as ciphertext and salt #27545

What

GET /system/inputs returns configuration fields marked as encrypted in their stored form, as {"encrypted_value": "...", "salt": "..."}, to any user holding inputs:read. The documented HTTP form is {"is_set": true}.

The value is AES ciphertext encrypted with the cluster password_secret, so this is not a disclosure of the secret itself.

Why it happens

InputServiceImpl.all() is the only Input read that does not apply withEncryptedFields(...). Its siblings paginated, allOfThisNode, allByType, findByIds and find all do. Without that conversion the field stays a raw Mongo sub-document rather than an EncryptedValue, so EncryptedValueSerializer never runs on it.