diff --git a/oslo_utils/strutils.py b/oslo_utils/strutils.py
index c22f4a0e..7d15a34a 100644
--- a/oslo_utils/strutils.py
+++ b/oslo_utils/strutils.py
@@ -53,7 +53,8 @@ SLUGIFY_HYPHENATE_RE = re.compile(r"[-\s]+")
 # NOTE(flaper87): The following globals are used by `mask_password`
 _SANITIZE_KEYS = ['adminPass', 'admin_pass', 'password', 'admin_password',
                   'auth_token', 'new_pass', 'auth_password', 'secret_uuid',
-                  'secret', 'sys_pswd', 'token', 'configdrive']
+                  'secret', 'sys_pswd', 'token', 'configdrive',
+                  'CHAPPASSWORD']
 
 # NOTE(ldbragst): Let's build a list of regex objects using the list of
 # _SANITIZE_KEYS we already have. This way, we only have to add the new key
@@ -265,6 +266,9 @@ def mask_password(message, secret="***"):  # nosec
 
     .. versionchanged:: 3.4
        Replace also ``'configdrive'`` key.
+
+    .. versionchanged:: 3.8
+       Replace also ``'CHAPPASSWORD'`` key.
     """
 
     try: