VaultGHSA-86c6-3g63-5w64

Hashicorp Vault Incorrect Permission Assignment for Critical Resource vulnerability

High7.6CVE-2023-5077 · Published Sep 29, 2023 · updated Sep 10, 2026

The Vault and Vault Enterprise ("Vault") Google Cloud secrets engine did not preserve existing Google Cloud IAM Conditions upon creating or updating rolesets. Fixed in Vault 1.13.0.

GitHub advisory

Affected versions

Package	Affected	Fixed in
github.com/hashicorp/vault Go	< 1.13.0	1.13.0

Details and references

CVSS 3.1: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
Severity from: GitHub (reviewed advisory)
Weakness: CWE-266, CWE-732
Also known as: BIT-vault-2023-5077, CVE-2023-5077, GO-2023-2088

More Vault advisories

All Vault

Date	Advisory	Severity	Fixed in
Dec 92023	Memory exhaustion in HashiCorp Vault High7.5Dec 9, 2023 CVE-2023-63371.13.12+2 more	High7.5	1.13.12+2 more
Nov 92023	HashiCorp Vault Missing Release of Memory after Effective Lifetime vulnerability High7.5Nov 9, 2023 CVE-2023-59541.13.10+2 more	High7.5	1.13.10+2 more
Sep 152023	HashiCorp Vault Improper Input Validation vulnerability Medium6.8Sep 15, 2023 CVE-2023-46801.12.11+2 more	Medium6.8	1.12.11+2 more
Aug 12023	HashiCorp Vault and Vault Enterprise vulnerable to user enumeration Medium5.3Aug 1, 2023 CVE-2023-34621.13.5+1 more	Medium5.3	1.13.5+1 more
Jul 62023	Hashicorp Vault Fails to Verify if Approle SecretID Belongs to Role During a Destroy Operation High8.1Jul 6, 2023 CVE-2023-249991.10.11+2 more	High8.1	1.10.11+2 more
Jul 62023	HashiCorp Vault's revocation list not respected Medium5.3Jul 6, 2023 CVE-2022-413161.9.10+2 more	Medium5.3	1.9.10+2 more

Affected versions

More Vault advisories

Critical advisories by email