Advisoriesby Ibis
Vault security advisories
55 advisories · 3 critical or high in 12 months · latest Apr 17
55 advisories
HashiCorp Vault Vulnerable to Denial-of-Service via Unauthenticated Root Token Generation/Rekey OperationsCVE-2026-5807no fix yetHashiCorp Vault May Expose Tokens to Auth Plugins Due to Incorrect Header SanitizationCVE-2026-4525no fix yetHashiCorp Vault has Server-Side Request Forgery in ACME Challenge Validation via Attacker-Controlled DNSCVE-2026-5052no fix yetHashiCorp Vault has a KVv2 Metadata and Secret Deletion Policy Bypass that leads to Denial-of-ServiceCVE-2026-3605no fix yetHashicorp Vault and Vault Enterprise vulnerable to a denial of service when processing JSONCVE-2025-12044fixed in 1.21.0HashiCorp Vault and Vault Enterprise's AWS Auth method may be susceptible to authentication bypassCVE-2025-11621fixed in 1.21.0HashiCorp Vault Community Edition Denial of Service Though Complex JSON PayloadsCVE-2025-6203fixed in 1.20.3HashiCorp Vault ldap auth method may not have correctly enforced MFACVE-2025-6013fixed in 1.20.2Hashicorp Vault has Incorrect Validation for Non-CA CertificatesCVE-2025-6037fixed in 1.20.1Hashicorp Vault has Privilege Escalation VulnerabilityCVE-2025-5999fixed in 1.20.0Hashicorp Vault has Code Execution Vulnerability via Plugin ConfigurationCVE-2025-6000fixed in 1.20.1Hashicorp Vault has an Observable Discrepancy on Existing and Non-Existing UsersCVE-2025-6011fixed in 1.20.1Hashicorp Vault has Lockout Feature Authentication BypassCVE-2025-6004fixed in 1.20.1Hashicorp Vault's TOTP Secrets Engine Susceptible to Code ReuseCVE-2025-6014fixed in 1.20.1Hashicorp Vault has Login MFA Rate Limit Bypass VulnerabilityCVE-2025-6015fixed in 1.20.1Vault Community Edition rekey and recovery key operations can cause denial of serviceCVE-2025-4656fixed in 1.20.0Hashicorp Vault Community vulnerable to Incorrect AuthorizationCVE-2025-3879fixed in 1.19.1Hashicorp Vault Community vulnerable to Generation of Error Message Containing Sensitive InformationCVE-2025-4166fixed in 1.19.3Hashicorp Vault vulnerable to denial of service through memory exhaustionCVE-2024-8185fixed in 1.18.1 +1Vault Community Edition privilege escalation vulnerabilityCVE-2024-9180fixed in 1.18.0 +1
Vault SSH Secrets Engine Configuration Did Not Restrict Valid Principals By DefaultCVE-2024-7594fixed in 0.0.0-20241003222810-d5b4e9224698 +1Vault Leaks Client Token and Token Accessor in Audit DevicesCVE-2024-8365fixed in 1.17.5Hashicorp Vault vulnerable to Improper Check or Handling of Exceptional ConditionsCVE-2024-6468fixed in 1.15.12 +2HashiCorp Vault Incorrectly Validated JSON Web Tokens (JWT) Audience ClaimsCVE-2024-5798fixed in 1.15.9 +2HashiCorpVault does not correctly validate OCSP responsesCVE-2024-2660fixed in 1.16.0Incorrect TLS certificate auth method in VaultCVE-2024-2048fixed in 1.14.10 +1Hashicorp Vault may expose sensitive log informationCVE-2024-0831fixed in 1.15.5Improper Authentication in HashiCorp VaultCVE-2021-3282fixed in 1.6.2Enumeration of users in HashiCorp VaultCVE-2020-35177fixed in 1.5.6 +1HashiCorp Vault Authentication bypassCVE-2020-16251fixed in 1.2.5 +3HashiCorp Vault Improper Privilege ManagementCVE-2020-10660fixed in 1.3.4HashiCorp Vault Improper Privilege ManagementCVE-2020-10661fixed in 1.3.4Memory exhaustion in HashiCorp VaultCVE-2023-6337fixed in 1.13.12 +2HashiCorp Vault Missing Release of Memory after Effective Lifetime vulnerabilityCVE-2023-5954fixed in 1.13.10 +2Hashicorp Vault Incorrect Permission Assignment for Critical Resource vulnerabilityCVE-2023-5077fixed in 1.13.0HashiCorp Vault Improper Input Validation vulnerabilityCVE-2023-4680fixed in 1.12.11 +2HashiCorp Vault and Vault Enterprise vulnerable to user enumerationCVE-2023-3462fixed in 1.13.5 +1Hashicorp Vault Fails to Verify if Approle SecretID Belongs to Role During a Destroy OperationCVE-2023-24999fixed in 1.10.11 +2HashiCorp Vault's revocation list not respectedCVE-2022-41316fixed in 1.9.10 +2Hashicorp Vault vulnerable to Cross-site ScriptingCVE-2023-2121fixed in 1.11.11 +2HashiCorp Vault's PKI mount vulnerable to denial of serviceCVE-2023-0665fixed in 1.11.9 +2HashiCorp Vault’s Microsoft SQL Database Storage Backend Vulnerable to SQL Injection Via Configuration FileCVE-2023-0620fixed in 1.11.9 +2HashiCorp Vault's implementation of Shamir's secret sharing vulnerable to cache-timing attacksCVE-2023-25000fixed in 1.11.9 +2HashiCorp Vault vulnerable to incorrect metadata accessCVE-2022-40186fixed in 1.9.9 +2Token leases could outlive their TTL in HashiCorp VaultCVE-2020-25816fixed in 1.5.4HashiCorp Vault improper configuration of multi factor authenticationCVE-2022-30689fixed in 1.10.3HashiCorp Vault Incorrect Permission Assignment for Critical ResourceCVE-2021-43998fixed in 1.7.6 +1Incorrect Privilege Assignment in HashiCorp VaultCVE-2021-42135no fix yetHashicorp Vault Privilege Escalation VulnerabilityCVE-2021-41802fixed in 1.7.5 +1HashiCorp Vault underlying database had excessively broad filesystem permissions from v1.4.0 until v1.8.0CVE-2021-38553fixed in 1.8.0Improper Removal of Sensitive Information Before Storage or Transfer in HashiCorp VaultCVE-2021-38554fixed in 1.6.6 +1Authentication Bypass by Spoofing and Insufficient Verification of Data Authenticity in Hashicorp VaultCVE-2020-16250fixed in 1.2.5 +3Improper Resource Shutdown or Release in HashiCorp VaultCVE-2020-7220fixed in 1.3.2Invalid session token expirationCVE-2021-32923fixed in 1.5.9 +2Information Disclosure in HashiCorp VaultCVE-2020-13223fixed in 1.3.6 +1About Vault
A tool for secrets management, encryption as a service, and privileged access management
Packages watched: github.com/hashicorp/vault (Go).
HashiCorp elsewhere on Ibis: Acquisitions · Paydays · Releases · Repos · TechConf