AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

VaultGHSA-fp52-qw33-mfmw

Authentication Bypass by Spoofing and Insufficient Verification of Data Authenticity in Hashicorp Vault

Vault

CVE-2020-16250 · Published Aug 2, 2021 · updated Sep 10, 2026

High8.2
Fix: upgrade to 1.2.5 or later (4 fixed versions below)
GitHub advisory

HashiCorp Vault and Vault Enterprise versions 0.7.1 and newer, when configured with the AWS IAM auth method, may be vulnerable to authentication bypass. Fixed in 1.2.5, 1.3.8, 1.4.4, and 1.5.1..

Affected versions

PackageAffectedFixed in
github.com/hashicorp/vault
Go
>= 0.8.1, < 1.2.51.2.5
>= 1.3.0, < 1.3.81.3.8
>= 1.4.0, < 1.4.41.4.4
>= 1.5.0, < 1.5.11.5.1
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-290, CWE-345
Also known as
BIT-vault-2020-16250, CVE-2020-16250, GO-2022-0825

More Vault advisories

All Vault
High 8.1Oct 12, 2021Incorrect Privilege Assignment in HashiCorp VaultCVE-2021-42135no fix yetLow 2.9Oct 12, 2021Hashicorp Vault Privilege Escalation VulnerabilityCVE-2021-41802fixed in 1.7.5 +1Critical 9.8Aug 30, 2021HashiCorp Vault underlying database had excessively broad filesystem permissions from v1.4.0 until v1.8.0CVE-2021-38553fixed in 1.8.0Medium 5.3Aug 30, 2021Improper Removal of Sensitive Information Before Storage or Transfer in HashiCorp VaultCVE-2021-38554fixed in 1.6.6 +1High 7.5Jul 28, 2021Improper Resource Shutdown or Release in HashiCorp VaultCVE-2020-7220fixed in 1.3.2High 7.4Jun 8, 2021Invalid session token expirationCVE-2021-32923fixed in 1.5.9 +2