AI and data stack advisories

Severe, 6 weeks1498Projects326

1498 severe, 6 weeks · 326 projects

VaultGHSA-86c6-3g63-5w64

Hashicorp Vault Incorrect Permission Assignment for Critical Resource vulnerability

Vault

CVE-2023-5077 · Published Sep 29, 2023 · updated Sep 10, 2026

High7.6
Fix: upgrade to 1.13.0 or later
GitHub advisory

The Vault and Vault Enterprise ("Vault") Google Cloud secrets engine did not preserve existing Google Cloud IAM Conditions upon creating or updating rolesets. Fixed in Vault 1.13.0.

Affected versions

PackageAffectedFixed in
github.com/hashicorp/vault
Go
< 1.13.01.13.0
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
Severity from
GitHub (reviewed advisory)
Weakness
CWE-266, CWE-732
Also known as
BIT-vault-2023-5077, CVE-2023-5077, GO-2023-2088

More Vault advisories

All Vault
High 7.5Dec 9, 2023Memory exhaustion in HashiCorp VaultCVE-2023-6337fixed in 1.13.12 +2High 7.5Nov 9, 2023HashiCorp Vault Missing Release of Memory after Effective Lifetime vulnerabilityCVE-2023-5954fixed in 1.13.10 +2Medium 6.8Sep 15, 2023HashiCorp Vault Improper Input Validation vulnerabilityCVE-2023-4680fixed in 1.12.11 +2Medium 5.3Aug 1, 2023HashiCorp Vault and Vault Enterprise vulnerable to user enumerationCVE-2023-3462fixed in 1.13.5 +1High 8.1Jul 6, 2023Hashicorp Vault Fails to Verify if Approle SecretID Belongs to Role During a Destroy OperationCVE-2023-24999fixed in 1.10.11 +2Medium 5.3Jul 6, 2023HashiCorp Vault's revocation list not respectedCVE-2022-41316fixed in 1.9.10 +2