AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

VaultGHSA-v84f-6r39-cpfc

HashiCorp Vault Improper Input Validation vulnerability

Vault

CVE-2023-4680 · Published Sep 15, 2023 · updated Aug 7, 2026

Medium6.8
Fix: upgrade to 1.12.11 or later (3 fixed versions below)
GitHub advisory

HashiCorp Vault and Vault Enterprise transit secrets engine allowed authorized users to specify arbitrary nonces, even with convergent encryption disabled. The encrypt endpoint, in combination with an offline attack, could be used to decrypt arbitrary ciphertext and potentially derive the authentication subkey when using transit secrets engine without convergent encryption. Introduced in 1.6.0 and fixed in 1.14.3, 1.13.7, and 1.12.11.

Affected versions

PackageAffectedFixed in
github.com/hashicorp/vault
Go
>= 1.6.0, < 1.12.111.12.11
>= 1.13.0, < 1.13.71.13.7
>= 1.14.0, < 1.14.31.14.3
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-20, CWE-323
Also known as
BIT-vault-2023-4680, CVE-2023-4680, GO-2023-2063

More Vault advisories

All Vault
High 7.5Dec 9, 2023Memory exhaustion in HashiCorp VaultCVE-2023-6337fixed in 1.13.12 +2High 7.5Nov 9, 2023HashiCorp Vault Missing Release of Memory after Effective Lifetime vulnerabilityCVE-2023-5954fixed in 1.13.10 +2High 7.6Sep 29, 2023Hashicorp Vault Incorrect Permission Assignment for Critical Resource vulnerabilityCVE-2023-5077fixed in 1.13.0Medium 5.3Aug 1, 2023HashiCorp Vault and Vault Enterprise vulnerable to user enumerationCVE-2023-3462fixed in 1.13.5 +1High 8.1Jul 6, 2023Hashicorp Vault Fails to Verify if Approle SecretID Belongs to Role During a Destroy OperationCVE-2023-24999fixed in 1.10.11 +2Medium 5.3Jul 6, 2023HashiCorp Vault's revocation list not respectedCVE-2022-41316fixed in 1.9.10 +2