Skip to content
OpenAdvisories

Package · Go

github.com/hashicorp/vault

55 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Low 3.7
    CVE-2025-6011

    Timing Side-Channel in Vault’s Userpass Auth Method

    A timing side channel in Vault and Vault Enterprise’s (“Vault”) userpass auth method allowed an attacker to distinguish between existing and non-existing users, and potentially enumerate valid usernames for Vault’s Userpass auth method. Fixed in Vault Communi…

    HashiCorp Vault Enterprise Vault github.com/hashicorp/vault Go
  • Low 3.1
    CVE-2025-4656

    Vault Vulnerable to Recovery Key Cancellation Denial of Service

    Vault Community and Vault Enterprise rekey and recovery key operations can lead to a denial of service due to uncontrolled cancellation by a Vault operator. This vulnerability (CVE-2025-4656) has been remediated in Vault Community Edition 1.20.0 and Vault Ent…

    HashiCorp Vault Enterprise Vault github.com/hashicorp/vault Go
  • Low 2.6
    CVE-2024-5798

    Vault Incorrectly Validated JSON Web Tokens (JWT) Audience Claims

    Vault and Vault Enterprise did not properly validate the JSON Web Token (JWT) role-bound audience claim when using the Vault JWT auth method. This may have resulted in Vault validating a JWT the audience and role-bound claims do not match, allowing an invalid…

    HashiCorp Vault Enterprise Vault github.com/hashicorp/vault Go
  • Low 2.9
    CVE-2021-41802

    Hashicorp Vault Privilege Escalation Vulnerability

    HashiCorp Vault and Vault Enterprise through 1.7.4 and 1.8.3 allowed a user with write permission to an entity alias ID sharing a mount accessor with another user to acquire this other user’s policies by merging their identities. Fixed in Vault and Vault Ente…

    github.com/hashicorp/vault Go