Advisoriesby IbisOpenBaoGHSA-jg74-mwgw-v6x3
Vault SSH Secrets Engine Configuration Did Not Restrict Valid Principals By Default
Fix: upgrade to 0.0.0-20241003222810-d5b4e9224698 or later (2 fixed versions below)
Vault’s SSH secrets engine did not require the valid_principals list to contain a value by default. If the valid_principals and default_user fields of the SSH secrets engine configuration are not set, an SSH certificate requested by an authorized user to Vault’s SSH secrets engine could be used to authenticate as any user on the host. Fixed in Vault Community Edition 1.17.6, and in Vault Enterprise 1.17.6, 1.16.10, and 1.15.15.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| github.com/openbao/openbao Go | >= 0.1.0 | No fix yet |
| < 0.0.0-20241003222810-d5b4e9224698 | 0.0.0-20241003222810-d5b4e9224698 | |
| github.com/hashicorp/vault Go | >= 1.7.7, < 1.17.6 | 1.17.6 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-732
- Also known as
- BIT-openbao-2024-7594, BIT-vault-2024-7594, CVE-2024-7594, GO-2024-3162
- nvd.nist.gov/vuln/detail/CVE-2024-7594
- github.com/openbao/openbao/pull/561
- github.com/openbao/openbao/commit/d5b4e922469830ac335b21dc0e8f9878c501a884
- discuss.hashicorp.com/t/hcsec-2024-20-vault-ssh-secrets-engine-configuration-did-not-restrict-valid-principals-by-default/70251
- github.com/hashicorp/vault
- openbao.org/docs/release-notes/2-0-0/#202
- pkg.go.dev/vuln/GO-2024-3162
- security.netapp.com/advisory/ntap-20250110-0007
More OpenBao advisories
All OpenBao
OpenBao TOTP Secrets Engine Code ReuseCVE-2025-55000fixed in 0.0.0-20250806193153-183891f8d535 +1OpenBao has a Timing Side-Channel in the Userpass Auth MethodCVE-2025-54999fixed in 0.0.0-20250806193356-4d9b5d3d6486 +1OpenBao Userpass and LDAP User Lockout BypassCVE-2025-54998fixed in 0.0.0-20250807212521-c52795c1ef74 +1Privileged OpenBao Operator May Execute Code on the Underlying HostCVE-2025-54997fixed in 0.0.0-20250806194004-a14053c9679d +1OpenBao Root Namespace Operator May Elevate Token PrivilegesCVE-2025-54996fixed in 0.0.0-20250806193240-9b0b5d4f345f +1OpenBao allows cancellation of root rekey and recovery rekey operations without authenticationCVE-2025-52894fixed in 0.0.0-20250625150133-fe75468822a2