Skip to main content
cve.nowby Sazabi
← Go
GoPackage

github.com/hashicorp/vault

55 known vulnerabilities (2 critical, 14 high, 20 medium, 4 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
55 · 2 critical, 14 high, 20 medium, 4 low
Registry
pkg.go.dev

Advisories 55

  • Vault Vulnerable to Denial-of-Service via Unauthenticated Root Token Generation/Rekey Operations

    Affected: all versions; through 1.21.4.

  • Vault Token Leaked to Backends via Authorization: Bearer Passthrough Header

    Affected: from 0.11.2; from 0.11.2, through 1.21.4.

  • CVE-2026-5052Medium 5.3

    Vault Vulnerable to Server-Side Request Forgery in ACME Challenge Validation via Attacker-Controlled DNS

    Affected: from 1.14.0, through 1.21.4; from 1.14.0.

  • Vault KVv2 Metadata and Secret Deletion Policy Bypass Denial-of-Service

    Affected: from 0.10.0, through 1.21.4; from 0.10.0.

  • Vault Vulnerable to Denial of Service Due to Rate Limit Regression

    Affected: from 1.20.3, fixed in 1.21.0.

  • Vault AWS auth method bypass due to AWS client cache

    Affected: from 0.6.0, fixed in 1.21.0.

  • Vault unauthenticated denial of service through complex json payload

    Affected: fixed in 1.20.3.

  • CVE-2025-6013Medium 6.5

    Vault LDAP MFA Enforcement Bypass When Using Username As Alias

    Affected: fixed in 1.20.2.

  • CVE-2025-6015Medium 5.7

    Vault Login MFA Bypass of Rate Limiting and TOTP Code Reuse

    Affected: from 1.10.0, fixed in 1.20.1.

  • Timing Side-Channel in Vault’s Userpass Auth Method

    Affected: fixed in 1.20.1.

  • CVE-2025-6004Medium 5.3

    Vault Userpass and LDAP User Lockout Bypass

    Affected: from 1.13.0, fixed in 1.20.1.

  • CVE-2025-6037Medium 6.8

    Vault Certificate Auth Method Did Not Validate Common Name For Non-CA Certificates

    Affected: fixed in 1.20.1.

  • CVE-2025-6014Medium 6.5

    Vault TOTP Secrets Engine Code Reuse

    Affected: fixed in 1.20.1.

  • CVE-2025-6000Critical 9.1

    Arbitrary Remote Code Execution via Plugin Catalog Abuse

    Affected: from 0.8.0, fixed in 1.20.1.

  • Vault Root Namespace Operator May Elevate Token Privileges

    Affected: from 0.10.4, fixed in 1.20.0.

Show all 55 advisoriesShow fewer advisories

  • Vault Vulnerable to Recovery Key Cancellation Denial of Service

    Affected: from 1.14.8, fixed in 1.20.0.

  • CVE-2025-3879Medium 6.6

    Vault’s Azure Authentication Method bound_location Restriction Could be Bypassed on Login

    Affected: from 1.10.0, fixed in 1.19.1.

  • CVE-2025-4166Medium 4.5

    Vault May Include Sensitive Data in Error Logs When Using the KV v2 Plugin

    Affected: from 0.3.0, fixed in 1.19.3.

  • Vault Vulnerable to Denial of Service When Processing Raft Join Requests

    Affected: from 1.2.0, fixed in 1.18.1.

  • Vault Operators in Root Namespace May Elevate Their Privileges

    Affected: fixed in 1.18.0.

  • Vault SSH Secrets Engine Configuration Did Not Restrict Valid Principals By Default

    Affected: from 1.7.7, fixed in 1.17.6.

  • CVE-2024-8365Medium 6.2

    Vault Leaks AppRole Client Tokens And Accessor in Audit Log

    Affected: from 1.17.3, fixed in 1.17.5.

  • Vault Vulnerable to Denial of Service When Setting a Proxy Protocol Behavior

    Affected: from 1.10.0, fixed in 1.15.12; from 1.16.0-rc1, fixed in 1.16.3; from 1.17.0-rc1, fixed in 1.17.2; from 1.10.0, fixed in 1.16.3; from 1.17.0-rc1, fixed in 1.17.2.

  • Vault Incorrectly Validated JSON Web Tokens (JWT) Audience Claims

    Affected: from 0.11.0, fixed in 1.16.3; from 1.17.0-rc1, fixed in 1.17.0; from 1.17.0-rc1, fixed in 1.17.0; from 1.16.0-rc1, fixed in 1.16.3; from 0.11.0, fixed in 1.15.9.

  • CVE-2024-2660Medium 6.4

    Vault TLS Cert Auth Method Did Not Correctly Validate OCSP Responses

    Affected: fixed in 1.16.0.

  • Vault Cert Auth Method Did Not Correctly Validate Non-CA Certificates

    Affected: from 1.15.0, fixed in 1.15.5; fixed in 1.14.10; fixed in 1.14.10; from 1.15.0, fixed in 1.15.5.

  • CVE-2024-0831Medium 4.5

    Vault May Expose Sensitive Information When Configuring An Audit Log Device

    Affected: from 1.15.0, fixed in 1.15.5.

  • Vault May be Vulnerable to a Denial of Service Through Memory Exhaustion When Handling Large HTTP Requests

    Affected: from 1.12.0, fixed in 1.13.12; from 1.14.0, fixed in 1.14.8; from 1.15.0, fixed in 1.15.4; from 1.15.0, fixed in 1.15.4; from 1.14.0, fixed in 1.14.8; from 1.12.0, fixed in 1.13.12.

  • CVE-2023-5954Medium 5.9

    Vault Requests Triggering Policy Checks May Lead To Unbounded Memory Consumption

    Affected: fixed in 1.13.10; from 1.14.0, fixed in 1.14.6; from 1.15.0, fixed in 1.15.2; fixed in 1.13.10; from 1.14.0, fixed in 1.14.6; from 1.15.0, fixed in 1.15.2.

  • Vault's Google Cloud Secrets Engine Removed Existing IAM Conditions When Creating / Updating Rolesets

    Affected: fixed in 1.13.0.

  • CVE-2023-4680Medium 6.8

    Vault's Transit Secrets Engine Allowed Nonce Specified without Convergent Encryption

    Affected: from 1.6.0, fixed in 1.12.11; from 1.13.0, fixed in 1.13.7; from 1.14.0, fixed in 1.14.3; from 1.6.0, fixed in 1.12.11; from 1.13.0, fixed in 1.13.7; from 1.14.0, fixed in 1.14.3.

  • CVE-2023-3462Medium 5.3

    Vault's LDAP Auth Method Allows for User Enumeration

    Affected: fixed in 1.13.5; from 1.14.0, fixed in 1.14.1; fixed in 1.13.5; from 1.14.0, fixed in 1.14.1.

  • CVE-2023-2121Medium 4.3

    Vault’s KV Diff Viewer Allowed for HTML Injection

    Affected: fixed in 1.11.11; from 1.12.0, fixed in 1.12.7; from 1.13.0, fixed in 1.13.3; fixed in 1.11.11; from 1.12.0, fixed in 1.12.7; from 1.13.0, fixed in 1.13.3.

  • CVE-2023-0620Medium 6.5

    Vault Vulnerable to SQL Injection When Configuring the Microsoft SQL Database Storage Backend

    Affected: from 0.8.0, fixed in 1.11.9; from 1.12.0, fixed in 1.12.5; from 1.13.0, fixed in 1.13.1; from 0.8.0, fixed in 1.11.9; from 1.12.0, fixed in 1.12.5; from 1.13.0, fixed in 1.13.1.

  • CVE-2023-0665Medium 6.5

    Vault PKI Issuer Endpoint Did Not Correctly Authorize Access to Issuer Metadata

    Affected: fixed in 1.11.9; from 1.12.0, fixed in 1.12.5; from 1.13.0, fixed in 1.13.1; fixed in 1.11.9; from 1.12.0, fixed in 1.12.5; from 1.13.0, fixed in 1.13.1.

  • CVE-2023-25000Medium 5.0

    Vault Vulnerable to Cache-Timing Attacks During Seal and Unseal Operations

    Affected: fixed in 1.11.9; from 1.12.0, fixed in 1.12.5; from 1.13.0, fixed in 1.13.1; fixed in 1.11.9; from 1.12.0, fixed in 1.12.5; from 1.13.0, fixed in 1.13.1.

  • CVE-2023-24999Medium 4.4

    Vault Fails to Verify if the AppRole SecretID Belongs to Role During a Destroy Operation

    Affected: fixed in 1.10.11; from 1.11.0, fixed in 1.11.8; from 1.12.0, fixed in 1.12.4; fixed in 1.10.11; from 1.11.0, fixed in 1.11.8; from 1.12.0, fixed in 1.12.4.

  • CVE-2022-41316Medium 5.3

    HashiCorp Vault and Vault Enterprise’s TLS certificate auth method did not initially load the optionally configured CRL issued by the…

    Affected: from 1.11.0, fixed in 1.11.4; from 1.10.0, fixed in 1.10.7; fixed in 1.9.10; fixed in 1.9.10; from 1.10.0, fixed in 1.10.7; from 1.11.0, fixed in 1.11.4.

  • CVE-2022-40186Critical 9.1

    An issue was discovered in HashiCorp Vault and Vault Enterprise before 1.11.3.

    Affected: from 1.11.0, fixed in 1.11.3; from 1.10.0, fixed in 1.10.6; from 1.8.0, fixed in 1.9.9; from 1.8.0, fixed in 1.9.9; from 1.10.0, fixed in 1.10.6; from 1.11.0, fixed in 1.11.3.

  • HashiCorp Vault and Vault Enterprise from 1.10.0 to 1.10.2 did not correctly configure and enforce MFA on login after server restarts.

    Affected: from 1.10.0, fixed in 1.10.3.

  • HashiCorp Vault and Vault Enterprise 0.11.0 up to 1.7.5 and 1.8.4 templated ACL policies would always match the first-created entity alias…

    Affected: from 0.11.0, fixed in 1.7.6; from 1.8.0, fixed in 1.8.5; from 0.11.0, fixed in 1.7.6; from 1.8.0, fixed in 1.8.5.

  • HashiCorp Vault and Vault Enterprise 1.8.x through 1.8.4 may have an unexpected interaction between glob-related policies and the Google…

    Affected: from 1.8.0, through 1.8.4; from 1.8.0, fixed in 1.8.5.

  • HashiCorp Vault and Vault Enterprise through 1.7.4 and 1.8.3 allowed a user with write permission to an entity alias ID sharing a mount…

    Affected: fixed in 1.7.5; from 1.8.0, fixed in 1.8.4; fixed in 1.7.5; from 1.8.0, fixed in 1.8.4.

  • HashiCorp Vault and Vault Enterprise 1.4.0 through 1.7.3 initialized an underlying database file associated with the Integrated Storage…

    Affected: from 1.4.0, fixed in 1.8.0.

  • HashiCorp Vault and Vault Enterprise’s UI erroneously cached and exposed user-viewed secrets between sessions in a single shared browser.

    Affected: fixed in 1.6.6; from 1.7.0, fixed in 1.7.4; fixed in 1.6.6; from 1.7.0, fixed in 1.7.4.

  • HashiCorp Vault and Vault Enterprise allowed the renewal of nearly-expired token leases and dynamic secret leases (specifically, those…

    Affected: from 0.10.0, fixed in 1.5.9; from 1.6.0, fixed in 1.6.5; from 1.7.0, fixed in 1.7.2; from 1.7.0, fixed in 1.7.2; from 1.6.0, fixed in 1.6.5; from 0.10.0, fixed in 1.5.9.

  • HashiCorp Vault Enterprise 1.6.0 & 1.6.1 allowed the `remove-peer` raft operator command to be executed against DR secondaries without…

    Affected: from 1.6.0, fixed in 1.6.2.

  • HashiCorp Vault and Vault Enterprise 1.4.1 and newer allowed the enumeration of users via the LDAP auth method.

    Affected: from 1.5.0, fixed in 1.5.6; from 1.6.0, fixed in 1.6.1; from 1.5.0, fixed in 1.5.6; from 1.6.0, fixed in 1.6.1.

  • HashiCorp Vault and Vault Enterprise versions 1.0 and newer allowed leases created with a batch token to outlive their TTL because…

    Affected: from 1.0.0-beta1, fixed in 1.5.4; from 1.0.0, fixed in 1.5.4.

  • HashiCorp Vault and Vault Enterprise versions 0.8.3 and newer, when configured with the GCP GCE auth method, may be vulnerable to…

    Affected: from 0.8.3, fixed in 1.2.5; from 1.3.0, fixed in 1.3.8; from 1.4.0, fixed in 1.4.4; from 1.5.0, fixed in 1.5.1; from 0.8.3, fixed in 1.2.5; from 1.3.0, fixed in 1.3.8; from 1.4.0, fixed in 1.4.4; from 1.5.0, fixed in 1.5.1.

  • HashiCorp Vault and Vault Enterprise versions 0.7.1 and newer, when configured with the AWS IAM auth method, may be vulnerable to…

    Affected: from 0.8.1, fixed in 1.2.5; from 1.3.0, fixed in 1.3.8; from 1.4.0, fixed in 1.4.4; from 1.5.0, fixed in 1.5.1; from 0.8.1, fixed in 1.2.5; from 1.3.0, fixed in 1.3.8; from 1.4.0, fixed in 1.4.4; from 1.5.0, fixed in 1.5.1.

  • HashiCorp Vault and Vault Enterprise logged proxy environment variables that potentially included sensitive credentials.

    Affected: from 1.3.0, fixed in 1.3.6; from 1.4.0, fixed in 1.4.2; from 1.3.0, fixed in 1.3.6; from 1.4.0, fixed in 1.4.2.

  • HashiCorp Vault and Vault Enterprise versions 0.11.0 through 1.3.3 may, under certain circumstances, have existing nested-path policies…

    Affected: from 0.11.0, fixed in 1.3.4.

  • HashiCorp Vault and Vault Enterprise versions 0.9.0 through 1.3.3 may, under certain circumstances, have an Entity's Group membership…

    Affected: from 0.9.0, fixed in 1.3.4.

  • HashiCorp Vault Enterprise 0.11.0 through 1.3.1 fails, in certain circumstances, to revoke dynamic secrets for a mount in a deleted…

    Affected: from 0.11.0, fixed in 1.3.2.