Hashicorp Vault Enterprise vulnerabilities

CVE-2025-6014 [MEDIUM] CWE-156 CVE-2025-6014: Vault and Vault Enterprise’s (“Vault”) TOTP Secrets Engine code validation endpoint is susceptible t Vault and Vault Enterprise’s (“Vault”) TOTP Secrets Engine code validation endpoint is susceptible to code reuse within its validity period. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23.

CVE-2023-5077 [HIGH] CWE-266 CVE-2023-5077: The Vault and Vault Enterprise ("Vault") Google Cloud secrets engine did not preserve existing Googl The Vault and Vault Enterprise ("Vault") Google Cloud secrets engine did not preserve existing Google Cloud IAM Conditions upon creating or updating rolesets. Fixed in Vault 1.13.0.

CVE-2023-5954 [HIGH] CWE-401 CVE-2023-5954: HashiCorp Vault and Vault Enterprise inbound client requests triggering a policy check can lead to a HashiCorp Vault and Vault Enterprise inbound client requests triggering a policy check can lead to an unbounded consumption of memory. A large number of these requests may lead to denial-of-service. Fixed in Vault 1.15.2, 1.14.6, and 1.13.10.

CVE-2024-0831 [MEDIUM] CWE-532 CVE-2024-0831: Vault and Vault Enterprise (“Vault”) may expose sensitive information when enabling an audit device Vault and Vault Enterprise (“Vault”) may expose sensitive information when enabling an audit device which specifies the `log_raw` option, which may log sensitive information to other audit devices, regardless of whether they are configured to use `log_raw`.

CVE-2024-8365 [MEDIUM] CWE-532 CVE-2024-8365: Vault Community Edition and Vault Enterprise experienced a regression where functionality that HMAC’ Vault Community Edition and Vault Enterprise experienced a regression where functionality that HMAC’d sensitive headers in the configured audit device, specifically client tokens and token accessors, was removed. This resulted in the plaintext values of client tokens and token accessors being stored in the audit log. This vulnerability, CVE-2024-8365,

CVE-2025-6037 [MEDIUM] CWE-295 CVE-2025-6037: Vault and Vault Enterprise (“Vault”) TLS certificate auth method did not correctly validate client c Vault and Vault Enterprise (“Vault”) TLS certificate auth method did not correctly validate client certificates when configured with a non-CA certificate as [+trusted certificate+|https://developer.hashicorp.com/vault/api-docs/auth/cert#certificate]. In this configuration, an attacker may be able to craft a malicious certificate that could be used to

CVE-2023-0620 [MEDIUM] CWE-89 CVE-2023-0620: HashiCorp Vault and Vault Enterprise versions 0.8.0 through 1.13.1 are vulnerable to an SQL injectio HashiCorp Vault and Vault Enterprise versions 0.8.0 through 1.13.1 are vulnerable to an SQL injection attack when configuring the Microsoft SQL (MSSQL) Database Storage Backend. When configuring the MSSQL plugin through the local, certain parameters are not sanitized when passed to the user-provided MSSQL database. An attacker may modify these paramete

CVE-2023-0665 [MEDIUM] CWE-285 CVE-2023-0665: HashiCorp Vault's PKI mount issuer endpoints did not correctly authorize access to remove an issuer HashiCorp Vault's PKI mount issuer endpoints did not correctly authorize access to remove an issuer or modify issuer metadata, potentially resulting in denial of service of the PKI mount. This bug did not affect public or private key material, trust chains or certificate issuance. Fixed in Vault 1.13.1, 1.12.5, and 1.11.9.

CVE-2024-2660 [MEDIUM] CWE-636 CVE-2024-2660: Vault and Vault Enterprise TLS certificates auth method did not correctly validate OCSP responses wh Vault and Vault Enterprise TLS certificates auth method did not correctly validate OCSP responses when one or more OCSP sources were configured. This vulnerability, CVE-2024-2660, affects Vault and Vault Enterprise 1.14.0 and above, and is fixed in Vault 1.16.0 and Vault Enterprise 1.16.1, 1.15.7, and 1.14.11.

CVE-2025-6015 [MEDIUM] CWE-307 CVE-2025-6015: Vault and Vault Enterprise’s (“Vault”) login MFA rate limits could be bypassed and TOTP tokens could Vault and Vault Enterprise’s (“Vault”) login MFA rate limits could be bypassed and TOTP tokens could be reused. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23.

CVE-2025-6004 [MEDIUM] CWE-307 CVE-2025-6004: Vault and Vault Enterprise’s (“Vault”) user lockout feature could be bypassed for Userpass and LDAP Vault and Vault Enterprise’s (“Vault”) user lockout feature could be bypassed for Userpass and LDAP authentication methods. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23.

CVE-2023-3462 [MEDIUM] CWE-203 CVE-2023-3462: HashiCorp's Vault and Vault Enterprise are vulnerable to user enumeration when using the LDAP auth m HashiCorp's Vault and Vault Enterprise are vulnerable to user enumeration when using the LDAP auth method. An attacker may submit requests of existent and non-existent LDAP users and observe the response from Vault to check if the account is valid on the LDAP server. This vulnerability is fixed in Vault 1.14.1 and 1.13.5.

CVE-2023-2121 [MEDIUM] CWE-79 CVE-2023-2121: Vault and Vault Enterprise's (Vault) key-value v2 (kv-v2) diff viewer allowed HTML injection into th Vault and Vault Enterprise's (Vault) key-value v2 (kv-v2) diff viewer allowed HTML injection into the Vault web UI through key values. This vulnerability, CVE-2023-2121, is fixed in Vault 1.14.0, 1.13.3, 1.12.7, and 1.11.11.

CVE-2024-2877 [MEDIUM] CWE-532 CVE-2024-2877: Vault Enterprise, when configured with performance standby nodes and a configured audit device, will Vault Enterprise, when configured with performance standby nodes and a configured audit device, will inadvertently log request headers on the standby node. These logs may have included sensitive HTTP request information in cleartext. This vulnerability, CVE-2024-2877, was fixed in Vault Enterprise 1.15.8.

CVE-2023-3775 [MEDIUM] CWE-266 CVE-2023-3775: A Vault Enterprise Sentinel Role Governing Policy created by an operator to restrict access to resou A Vault Enterprise Sentinel Role Governing Policy created by an operator to restrict access to resources in one namespace can be applied to requests outside in another non-descendant namespace, potentially resulting in denial of service. Fixed in Vault Enterprise 1.15.0, 1.14.4, 1.13.8.

CVE-2023-25000 [MEDIUM] CWE-208 CVE-2023-25000: HashiCorp Vault's implementation of Shamir's secret sharing used precomputed table lookups, and was HashiCorp Vault's implementation of Shamir's secret sharing used precomputed table lookups, and was vulnerable to cache-timing attacks. An attacker with access to, and the ability to observe a large number of unseal operations on the host through a side channel may reduce the search space of a brute force effort to recover the Shamir shares. Fixed in

CVE-2023-3774 [MEDIUM] CWE-248 CVE-2023-3774: An unhandled error in Vault Enterprise's namespace creation may cause the Vault process to crash, po An unhandled error in Vault Enterprise's namespace creation may cause the Vault process to crash, potentially resulting in denial of service. Fixed in 1.14.1, 1.13.5, and 1.12.9.

CVE-2025-6011 [LOW] CWE-203 CVE-2025-6011: A timing side channel in Vault and Vault Enterprise’s (“Vault”) userpass auth method allowed an atta A timing side channel in Vault and Vault Enterprise’s (“Vault”) userpass auth method allowed an attacker to distinguish between existing and non-existing users, and potentially enumerate valid usernames for Vault’s Userpass auth method. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23.

CVE-2025-4656 [LOW] CWE-1088 CVE-2025-4656: Vault Community and Vault Enterprise rekey and recovery key operations can lead to a denial of servi Vault Community and Vault Enterprise rekey and recovery key operations can lead to a denial of service due to uncontrolled cancellation by a Vault operator. This vulnerability (CVE-2025-4656) has been remediated in Vault Community Edition 1.20.0 and Vault Enterprise 1.20.0, 1.19.6, 1.18.11, 1.17.17, and 1.16.22.

CVE-2023-2197 [LOW] CWE-326 CVE-2023-2197: HashiCorp Vault Enterprise 1.13.0 up to 1.13.1 is vulnerable to a padding oracle attack when using a HashiCorp Vault Enterprise 1.13.0 up to 1.13.1 is vulnerable to a padding oracle attack when using an HSM in conjunction with the CKM_AES_CBC_PAD or CKM_AES_CBC encryption mechanisms. An attacker with privileges to modify storage and restart Vault may be able to intercept or modify cipher text in order to derive Vault’s root key. Fixed in 1.13.2