Skip to content
OpenAdvisories

Package · Go

github.com/hashicorp/vault

55 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Critical 9.1
    CVE-2025-6000

    Arbitrary Remote Code Execution via Plugin Catalog Abuse

    A privileged Vault operator within the root namespace with write permission to {{sys/audit}} may obtain code execution on the underlying host if a plugin directory is set in Vault’s configuration. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1…

    HashiCorp Vault Enterprise Vault github.com/hashicorp/vault Go
  • Critical 9.1
    CVE-2022-40186

    HashiCorp Vault vulnerable to incorrect metadata access

    An issue was discovered in HashiCorp Vault and Vault Enterprise before 1.11.3. A vulnerability in the Identity Engine was found where, in a deployment where an entity has multiple mount accessors with shared alias names, Vault may overwrite metadata to the wr…

    github.com/hashicorp/vault Go
  • Critical 9.1
    CVE-2021-43998

    HashiCorp Vault Incorrect Permission Assignment for Critical Resource

    HashiCorp Vault and Vault Enterprise 0.11.0 up to 1.7.5 and 1.8.4 templated ACL policies would always match the first-created entity alias if multiple entity aliases exist for a specified entity and mount combination, potentially resulting in incorrect policy…

    github.com/hashicorp/vault Go
  • Critical 9.8
    CVE-2021-38553

    HashiCorp Vault underlying database had excessively broad filesystem permissions from v1.4.0 until v1.8.0

    HashiCorp Vault and Vault Enterprise 1.4.0 through 1.7.3 initialized an underlying database file associated with the Integrated Storage feature with excessively broad filesystem permissions. Fixed in Vault and Vault Enterprise 1.8.0.

    github.com/hashicorp/vault Go
  • Critical 9.8
    CVE-2020-25816

    Token leases could outlive their TTL in HashiCorp Vault

    HashiCorp Vault and Vault Enterprise versions 1.0 and newer allowed leases created with a batch token to outlive their TTL because expiration time was not scheduled correctly. Fixed in 1.4.7 and 1.5.4.

    github.com/hashicorp/vault vault Alpine Go
  • Critical 9.1
    CVE-2020-10661

    HashiCorp Vault Improper Privilege Management

    HashiCorp Vault and Vault Enterprise versions 0.11.0 through 1.3.3 may, under certain circumstances, have existing nested-path policies grant access to Namespaces created after-the-fact. Fixed in 1.3.4.

    github.com/hashicorp/vault Go