Description
HashiCorp Vault and Vault Enterprise 0.11.0 up to 1.7.5 and 1.8.4 templated ACL policies would always match the first-created entity alias if multiple entity aliases exist for a specified entity and mount combination, potentially resulting in incorrect policy enforcement. Fixed in Vault and Vault Enterprise 1.7.6, 1.8.5, and 1.9.0.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/hashicorp/vault | >= 0.11.0, < 1.7.6 | 1.7.6 | GHSA-pfmw-vj74-ph8g |
| Go | github.com/hashicorp/vault | >= 1.8.0, < 1.8.5 | 1.8.5 | GHSA-pfmw-vj74-ph8g |
| Go | github.com/hashicorp/vault | >= 0.11.0, < 1.7.6 · >= 1.8.0, < 1.8.5 | 1.7.6, 1.8.5 | GO-2022-0611 |
Advisories 2
- WID-SEC-2023-1542 Red Hat OpenShift: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 18, 2025
- WID-SEC-2022-0918 Hashicorp Vault: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen BSI CERT-Bund (WID) · May 18, 2023