AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

VaultGHSA-57gg-cj55-q5g2

Token leases could outlive their TTL in HashiCorp Vault

Vault

CVE-2020-25816 · Published May 24, 2022 · updated Feb 3, 2026

Critical9.8
Fix: upgrade to 1.5.4 or later
GitHub advisory

HashiCorp Vault and Vault Enterprise 1.0 before 1.5.4 have Incorrect Access Control.

Affected versions

PackageAffectedFixed in
github.com/hashicorp/vault
Go
>= 1.0.0-beta1, < 1.5.41.5.4
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity from
GitHub (reviewed advisory)
Weakness
CWE-613
Also known as
BIT-vault-2020-25816, CVE-2020-25816, GO-2024-2514

More Vault advisories

All Vault
Critical 9.1Sep 23, 2022HashiCorp Vault vulnerable to incorrect metadata accessCVE-2022-40186fixed in 1.9.9 +2Medium 5.3May 18, 2022HashiCorp Vault improper configuration of multi factor authenticationCVE-2022-30689fixed in 1.10.3Critical 9.1Dec 2, 2021HashiCorp Vault Incorrect Permission Assignment for Critical ResourceCVE-2021-43998fixed in 1.7.6 +1High 8.1Oct 12, 2021Incorrect Privilege Assignment in HashiCorp VaultCVE-2021-42135no fix yetLow 2.9Oct 12, 2021Hashicorp Vault Privilege Escalation VulnerabilityCVE-2021-41802fixed in 1.7.5 +1Critical 9.8Aug 30, 2021HashiCorp Vault underlying database had excessively broad filesystem permissions from v1.4.0 until v1.8.0CVE-2021-38553fixed in 1.8.0