Advisoriesby IbisVaultGHSA-rr8j-7w34-xp5j
Vault Community Edition privilege escalation vulnerability
Fix: upgrade to 1.18.0 or later (2 fixed versions below)
A privileged Vault operator with write permissions to the root namespace’s identity endpoint could escalate their privileges to Vault’s root policy. Fixed in Vault Community Edition 1.18.0 and Vault Enterprise 1.18.0, 1.17.7, 1.16.11, and 1.15.16
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| github.com/openbao/openbao Go | < 2.0.3 | 2.0.3 |
| github.com/hashicorp/vault Go | < 1.18.0 | 1.18.0 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-266
- Also known as
- BIT-openbao-2024-9180, BIT-vault-2024-9180, CVE-2024-9180, GO-2024-3191
More Vault advisories
All Vault
Hashicorp Vault Community vulnerable to Generation of Error Message Containing Sensitive InformationCVE-2025-4166fixed in 1.19.3Hashicorp Vault vulnerable to denial of service through memory exhaustionCVE-2024-8185fixed in 1.18.1 +1Vault Leaks Client Token and Token Accessor in Audit DevicesCVE-2024-8365fixed in 1.17.5Hashicorp Vault vulnerable to Improper Check or Handling of Exceptional ConditionsCVE-2024-6468fixed in 1.15.12 +2HashiCorp Vault Incorrectly Validated JSON Web Tokens (JWT) Audience ClaimsCVE-2024-5798fixed in 1.15.9 +2HashiCorpVault does not correctly validate OCSP responsesCVE-2024-2660fixed in 1.16.0