Skip to content
OpenAdvisories

Package · Go

github.com/hashicorp/vault

55 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

55 results · Feed

  • Critical 9.1
    CVE-2021-43998

    HashiCorp Vault Incorrect Permission Assignment for Critical Resource

    HashiCorp Vault and Vault Enterprise 0.11.0 up to 1.7.5 and 1.8.4 templated ACL policies would always match the first-created entity alias if multiple entity aliases exist for a specified entity and mount combination, potentially resulting in incorrect policy…

    github.com/hashicorp/vault Go
  • High 8.1
    CVE-2021-42135

    Incorrect Privilege Assignment in HashiCorp Vault

    HashiCorp Vault and Vault Enterprise 1.8.x through 1.8.4 may have an unexpected interaction between glob-related policies and the Google Cloud secrets engine. Users may, in some situations, have more privileges than intended, e.g., a user with read permission…

    github.com/hashicorp/vault Go
  • Low 2.9
    CVE-2021-41802

    Hashicorp Vault Privilege Escalation Vulnerability

    HashiCorp Vault and Vault Enterprise through 1.7.4 and 1.8.3 allowed a user with write permission to an entity alias ID sharing a mount accessor with another user to acquire this other user’s policies by merging their identities. Fixed in Vault and Vault Ente…

    github.com/hashicorp/vault Go
  • Critical 9.8
    CVE-2021-38553

    HashiCorp Vault underlying database had excessively broad filesystem permissions from v1.4.0 until v1.8.0

    HashiCorp Vault and Vault Enterprise 1.4.0 through 1.7.3 initialized an underlying database file associated with the Integrated Storage feature with excessively broad filesystem permissions. Fixed in Vault and Vault Enterprise 1.8.0.

    github.com/hashicorp/vault Go
  • Medium 5.3
    CVE-2021-38554

    Improper Removal of Sensitive Information Before Storage or Transfer in HashiCorp Vault

    HashiCorp Vault and Vault Enterprise’s UI erroneously cached and exposed user-viewed secrets between sessions in a single shared browser. Fixed in 1.8.0 and pending 1.7.4 / 1.6.6 releases.

    github.com/hashicorp/vault vault Alpine Go
  • High 7.4
    CVE-2021-32923

    Invalid session token expiration

    HashiCorp Vault and Vault Enterprise allowed the renewal of nearly-expired token leases and dynamic secret leases (specifically, those within 1 second of their maximum TTL), which caused them to be incorrectly treated as non-expiring during subsequent use. Fi…

    github.com/hashicorp/vault vault Alpine Go
  • High 7.5
    CVE-2021-3282

    Improper Authentication in HashiCorp Vault

    HashiCorp Vault Enterprise 1.6.0 & 1.6.1 allowed the `remove-peer` raft operator command to be executed against DR secondaries without authentication. Fixed in 1.6.2.

    github.com/hashicorp/vault vault Alpine Go
  • Medium 6.5
    CVE-2020-35177

    Enumeration of users in HashiCorp Vault

    HashiCorp Vault and Vault Enterprise 1.4.1 and newer allowed the enumeration of users via the LDAP auth method. Fixed in 1.5.6 and 1.6.1.

    github.com/hashicorp/vault vault Alpine Go
  • Critical 9.8
    CVE-2020-25816

    Token leases could outlive their TTL in HashiCorp Vault

    HashiCorp Vault and Vault Enterprise versions 1.0 and newer allowed leases created with a batch token to outlive their TTL because expiration time was not scheduled correctly. Fixed in 1.4.7 and 1.5.4.

    github.com/hashicorp/vault vault Alpine Go
  • High 8.2
    CVE-2020-16251

    HashiCorp Vault Authentication bypass

    HashiCorp Vault and Vault Enterprise versions 0.8.3 and newer, when configured with the GCP GCE auth method, may be vulnerable to authentication bypass. Fixed in 1.2.5, 1.3.8, 1.4.4, and 1.5.1.

    github.com/hashicorp/vault vault Alpine Go
  • High 8.2
    CVE-2020-16250

    Authentication Bypass by Spoofing and Insufficient Verification of Data Authenticity in Hashicorp Vault

    HashiCorp Vault and Vault Enterprise versions 0.7.1 and newer, when configured with the AWS IAM auth method, may be vulnerable to authentication bypass. Fixed in 1.2.5, 1.3.8, 1.4.4, and 1.5.1..

    github.com/hashicorp/vault vault Alpine Go
  • High 7.5
    CVE-2020-13223

    Information Disclosure in HashiCorp Vault

    HashiCorp Vault and Vault Enterprise logged proxy environment variables that potentially included sensitive credentials. Fixed in 1.3.6 and 1.4.2.

    github.com/hashicorp/vault vault Alpine Go
  • Critical 9.1
    CVE-2020-10661

    HashiCorp Vault Improper Privilege Management

    HashiCorp Vault and Vault Enterprise versions 0.11.0 through 1.3.3 may, under certain circumstances, have existing nested-path policies grant access to Namespaces created after-the-fact. Fixed in 1.3.4.

    github.com/hashicorp/vault Go
  • Medium 5.3
    CVE-2020-10660

    HashiCorp Vault Improper Privilege Management

    HashiCorp Vault and Vault Enterprise versions 0.9.0 through 1.3.3 may, under certain circumstances, have an Entity's Group membership inadvertently include Groups the Entity no longer has permissions to. Fixed in 1.3.4.

    github.com/hashicorp/vault Go
  • High 7.5
    CVE-2020-7220

    Improper Resource Shutdown or Release in HashiCorp Vault

    HashiCorp Vault Enterprise 0.11.0 through 1.3.1 fails, in certain circumstances, to revoke dynamic secrets for a mount in a deleted namespace. Fixed in 1.3.2.

    github.com/hashicorp/vault Go