Github.Com Hashicorp Vault vulnerabilities

CVE-2021-3282 [HIGH] CWE-287 Improper Authentication in HashiCorp Vault Improper Authentication in HashiCorp Vault HashiCorp Vault Enterprise 1.6.0 & 1.6.1 allowed the `remove-peer` raft operator command to be executed against DR secondaries without authentication. Fixed in 1.6.2.

CVE-2024-5798 [HIGH] CWE-285 HashiCorp Vault Incorrectly Validated JSON Web Tokens (JWT) Audience Claims HashiCorp Vault Incorrectly Validated JSON Web Tokens (JWT) Audience Claims Vault and Vault Enterprise did not properly validate the JSON Web Token (JWT) role-bound audience claim when using the Vault JWT auth method. This may have resulted in Vault validating a JWT the audience and role-bound claims do not match, allowing an invalid login to succeed when it should have been rejected. This

CVE-2024-6468 [HIGH] CWE-703 Hashicorp Vault vulnerable to Improper Check or Handling of Exceptional Conditions Hashicorp Vault vulnerable to Improper Check or Handling of Exceptional Conditions Vault and Vault Enterprise did not properly handle requests originating from unauthorized IP addresses when the TCP listener option, proxy_protocol_behavior, was set to deny_unauthorized. When receiving a request from a source IP address that was not listed in proxy_protocol_authorized_addrs, the Vault

CVE-2021-42135 [HIGH] CWE-266 Incorrect Privilege Assignment in HashiCorp Vault Incorrect Privilege Assignment in HashiCorp Vault HashiCorp Vault and Vault Enterprise 1.8.x through 1.8.4 may have an unexpected interaction between glob-related policies and the Google Cloud secrets engine. Users may, in some situations, have more privileges than intended, e.g., a user with read permission for the /gcp/roleset/* path may be able to issue Google Cloud service account credentials.

CVE-2023-4680 [MEDIUM] CWE-20 HashiCorp Vault Improper Input Validation vulnerability HashiCorp Vault Improper Input Validation vulnerability HashiCorp Vault and Vault Enterprise transit secrets engine allowed authorized users to specify arbitrary nonces, even with convergent encryption disabled. The encrypt endpoint, in combination with an offline attack, could be used to decrypt arbitrary ciphertext and potentially derive the authentication subkey when using transit secrets engine without con

CVE-2021-32923 [HIGH] CWE-613 Invalid session token expiration Invalid session token expiration HashiCorp Vault and Vault Enterprise allowed the renewal of nearly-expired token leases and dynamic secret leases (specifically, those within 1 second of their maximum TTL), which caused them to be incorrectly treated as non-expiring during subsequent use. Fixed in 1.5.9, 1.6.5, and 1.7.2.

CVE-2020-7220 [HIGH] CWE-404 Improper Resource Shutdown or Release in HashiCorp Vault Improper Resource Shutdown or Release in HashiCorp Vault HashiCorp Vault Enterprise 0.11.0 through 1.3.1 fails, in certain circumstances, to revoke dynamic secrets for a mount in a deleted namespace. Fixed in 1.3.2.

CVE-2023-6337 [HIGH] CWE-770 Memory exhaustion in HashiCorp Vault Memory exhaustion in HashiCorp Vault HashiCorp Vault and Vault Enterprise 1.12.0 and newer are vulnerable to a denial of service through memory exhaustion of the host when handling large unauthenticated and authenticated HTTP requests from a client. Vault will attempt to map the request to memory, resulting in the exhaustion of available memory on the host, which may cause Vault to crash. Fixed in Vault 1.15.4, 1.14.8, 1.13.12.

CVE-2025-6014 [MEDIUM] CWE-156 Hashicorp Vault's TOTP Secrets Engine Susceptible to Code Reuse Hashicorp Vault's TOTP Secrets Engine Susceptible to Code Reuse Vault and Vault Enterprise’s (“Vault”) TOTP Secrets Engine code validation endpoint is susceptible to code reuse within its validity period. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23.

CVE-2023-5077 [HIGH] CWE-266 Hashicorp Vault Incorrect Permission Assignment for Critical Resource vulnerability Hashicorp Vault Incorrect Permission Assignment for Critical Resource vulnerability The Vault and Vault Enterprise ("Vault") Google Cloud secrets engine did not preserve existing Google Cloud IAM Conditions upon creating or updating rolesets. Fixed in Vault 1.13.0.

CVE-2023-5954 [HIGH] CWE-401 HashiCorp Vault Missing Release of Memory after Effective Lifetime vulnerability HashiCorp Vault Missing Release of Memory after Effective Lifetime vulnerability HashiCorp Vault and Vault Enterprise inbound client requests triggering a policy check can lead to an unbounded consumption of memory. A large number of these requests may lead to denial-of-service. Fixed in Vault 1.15.2, 1.14.6, and 1.13.10.

CVE-2024-8365 [MEDIUM] CWE-532 Vault Leaks Client Token and Token Accessor in Audit Devices Vault Leaks Client Token and Token Accessor in Audit Devices Vault Community Edition and Vault Enterprise experienced a regression where functionality that HMAC’d sensitive headers in the configured audit device, specifically client tokens and token accessors, was removed. This resulted in the plaintext values of client tokens and token accessors being stored in the audit log. This vulnerability, CVE-202

CVE-2025-4166 [MEDIUM] CWE-209 Hashicorp Vault Community vulnerable to Generation of Error Message Containing Sensitive Information Hashicorp Vault Community vulnerable to Generation of Error Message Containing Sensitive Information Vault Community and Vault Enterprise Key/Value (kv) Version 2 plugin may unintentionally expose sensitive information in server and audit logs when users submit malformed payloads during secret creation or update operations via the Vault REST API. This vulnerability

CVE-2020-13223 [HIGH] CWE-200 Information Disclosure in HashiCorp Vault Information Disclosure in HashiCorp Vault HashiCorp Vault and Vault Enterprise before 1.3.6, and 1.4.2 before 1.4.2, insert Sensitive Information into a Log File. The vulnerability is affecting `github.com/hashicorp/vault/command` Go package.

CVE-2024-0831 [MEDIUM] CWE-532 Hashicorp Vault may expose sensitive log information Hashicorp Vault may expose sensitive log information Vault and Vault Enterprise (“Vault”) may expose sensitive information when enabling an audit device which specifies the `log_raw` option, which may log sensitive information to other audit devices, regardless of whether they are configured to use `log_raw`

CVE-2020-25816 [CRITICAL] CWE-613 Token leases could outlive their TTL in HashiCorp Vault Token leases could outlive their TTL in HashiCorp Vault HashiCorp Vault and Vault Enterprise 1.0 before 1.5.4 have Incorrect Access Control.

CVE-2021-43998 [CRITICAL] CWE-732 HashiCorp Vault Incorrect Permission Assignment for Critical Resource HashiCorp Vault Incorrect Permission Assignment for Critical Resource HashiCorp Vault and Vault Enterprise 0.11.0 up to 1.7.5 and 1.8.4 templated ACL policies would always match the first-created entity alias if multiple entity aliases exist for a specified entity and mount combination, potentially resulting in incorrect policy enforcement. Fixed in Vault and Vault Enterprise 1.7.6, 1.8.5, an

CVE-2025-6037 [MEDIUM] CWE-295 Hashicorp Vault has Incorrect Validation for Non-CA Certificates Hashicorp Vault has Incorrect Validation for Non-CA Certificates Vault and Vault Enterprise (“Vault”) TLS certificate auth method did not correctly validate client certificates when configured with a non-CA certificate as [+trusted certificate+|https://developer.hashicorp.com/vault/api-docs/auth/cert#certificate]. In this configuration, an attacker may be able to craft a malicious certificate that co

CVE-2023-0620 [MEDIUM] CWE-89 HashiCorp Vault’s Microsoft SQL Database Storage Backend Vulnerable to SQL Injection Via Configuration File HashiCorp Vault’s Microsoft SQL Database Storage Backend Vulnerable to SQL Injection Via Configuration File HashiCorp Vault and Vault Enterprise versions 0.8.0 until 1.13.1 are vulnerable to an SQL injection attack when using the Microsoft SQL (MSSQL) Database Storage Backend. When configuring the MSSQL plugin, certain parameters are required to establish a c

CVE-2023-0665 [MEDIUM] CWE-285 HashiCorp Vault's PKI mount vulnerable to denial of service HashiCorp Vault's PKI mount vulnerable to denial of service HashiCorp Vault's PKI mount issuer endpoints did not correctly authorize access to remove an issuer or modify issuer metadata, potentially resulting in denial of service of the PKI mount. This bug did not affect public or private key material, trust chains or certificate issuance. Fixed in Vault 1.13.1, 1.12.5, and 1.11.9.