Description
HashiCorp Vault's PKI mount issuer endpoints did not correctly authorize access to remove an issuer or modify issuer metadata, potentially resulting in denial of service of the PKI mount. This bug did not affect public or private key material, trust chains or certificate issuance. Fixed in Vault 1.13.1, 1.12.5, and 1.11.9.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| HashiCorp | Vault | 1.13.0 – < 1.13.1, 1.12.0 – < 1.12.5, 1.11.0 – < 1.11.9 | 1.13.1 |
| HashiCorp | Vault Enterprise | 1.13.0 – < 1.13.1, 1.12.0 – < 1.12.5, 1.11.0 – < 1.11.9 | 1.13.1 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | k3d +2 | 5.6.0-r11 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/hashicorp/vault | < 1.11.9 | 1.11.9 | GHSA-hwc3-3qh6-r4gg |
| Go | github.com/hashicorp/vault | >= 1.12.0, < 1.12.5 | 1.12.5 | GHSA-hwc3-3qh6-r4gg |
| Go | github.com/hashicorp/vault | >= 1.13.0, < 1.13.1 | 1.13.1 | GHSA-hwc3-3qh6-r4gg |
| Go | github.com/hashicorp/vault | < 1.11.9 · >= 1.12.0, < 1.12.5 · >= 1.13.0, < 1.13.1 | 1.11.9, 1.12.5, 1.13.1 | GO-2023-1708 |
Advisories 2
- WID-SEC-2023-1542 Red Hat OpenShift: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 18, 2025
- WID-SEC-2023-0795 Hashicorp Vault: Mehrere Schwachstellen BSI CERT-Bund (WID) · Mar 29, 2023