# github.com/hashicorp/vault (Go) vulnerabilities

55 known vulnerabilities (2 critical, 14 high, 20 medium, 4 low), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://pkg.go.dev/github.com/hashicorp/vault

## Advisories (55)

### [CVE-2026-5807](https://cve.now/CVE-2026-5807): Vault Vulnerable to Denial-of-Service via Unauthenticated Root Token Generation/Rekey Operations

- Severity: High 7.5
- Published: Apr 17, 2026
- Affected: all versions; through 1.21.4.

### [CVE-2026-4525](https://cve.now/CVE-2026-4525): Vault Token Leaked to Backends via Authorization: Bearer Passthrough Header

- Severity: High 7.5
- Published: Apr 17, 2026
- Affected: from 0.11.2; from 0.11.2, through 1.21.4.

### [CVE-2026-5052](https://cve.now/CVE-2026-5052): Vault Vulnerable to Server-Side Request Forgery in ACME Challenge Validation via Attacker-Controlled DNS

- Severity: Medium 5.3
- Published: Apr 17, 2026
- Affected: from 1.14.0, through 1.21.4; from 1.14.0.

### [CVE-2026-3605](https://cve.now/CVE-2026-3605): Vault KVv2 Metadata and Secret Deletion Policy Bypass Denial-of-Service

- Severity: High 8.1
- Published: Apr 17, 2026
- Affected: from 0.10.0, through 1.21.4; from 0.10.0.

### [CVE-2025-12044](https://cve.now/CVE-2025-12044): Vault Vulnerable to Denial of Service Due to Rate Limit Regression

- Severity: High 7.5
- Published: Oct 23, 2025
- Affected: from 1.20.3, fixed in 1.21.0.

### [CVE-2025-11621](https://cve.now/CVE-2025-11621): Vault AWS auth method bypass due to AWS client cache

- Severity: High 8.1
- Published: Oct 23, 2025
- Affected: from 0.6.0, fixed in 1.21.0.

### [CVE-2025-6203](https://cve.now/CVE-2025-6203): Vault unauthenticated denial of service through complex json payload

- Severity: High 7.5
- Published: Aug 28, 2025
- Affected: fixed in 1.20.3.

### [CVE-2025-6013](https://cve.now/CVE-2025-6013): Vault LDAP MFA Enforcement Bypass When Using Username As Alias

- Severity: Medium 6.5
- Published: Aug 6, 2025
- Affected: fixed in 1.20.2.

### [CVE-2025-6015](https://cve.now/CVE-2025-6015): Vault Login MFA Bypass of Rate Limiting and TOTP Code Reuse

- Severity: Medium 5.7
- Published: Aug 1, 2025
- Affected: from 1.10.0, fixed in 1.20.1.

### [CVE-2025-6011](https://cve.now/CVE-2025-6011): Timing Side-Channel in Vault’s Userpass Auth Method

- Severity: Low 3.7
- Published: Aug 1, 2025
- Affected: fixed in 1.20.1.

### [CVE-2025-6004](https://cve.now/CVE-2025-6004): Vault Userpass and LDAP User Lockout Bypass

- Severity: Medium 5.3
- Published: Aug 1, 2025
- Affected: from 1.13.0, fixed in 1.20.1.

### [CVE-2025-6037](https://cve.now/CVE-2025-6037): Vault Certificate Auth Method Did Not Validate Common Name For Non-CA Certificates

- Severity: Medium 6.8
- Published: Aug 1, 2025
- Affected: fixed in 1.20.1.

### [CVE-2025-6014](https://cve.now/CVE-2025-6014): Vault TOTP Secrets Engine Code Reuse

- Severity: Medium 6.5
- Published: Aug 1, 2025
- Affected: fixed in 1.20.1.

### [CVE-2025-6000](https://cve.now/CVE-2025-6000): Arbitrary Remote Code Execution via Plugin Catalog Abuse

- Severity: Critical 9.1
- Published: Aug 1, 2025
- Affected: from 0.8.0, fixed in 1.20.1.

### [CVE-2025-5999](https://cve.now/CVE-2025-5999): Vault Root Namespace Operator May Elevate Token Privileges

- Severity: High 7.2
- Published: Aug 1, 2025
- Affected: from 0.10.4, fixed in 1.20.0.

### [CVE-2025-4656](https://cve.now/CVE-2025-4656): Vault Vulnerable to Recovery Key Cancellation Denial of Service

- Severity: Low 3.1
- Published: Jun 25, 2025
- Affected: from 1.14.8, fixed in 1.20.0.

### [CVE-2025-3879](https://cve.now/CVE-2025-3879): Vault’s Azure Authentication Method bound\_location Restriction Could be Bypassed on Login

- Severity: Medium 6.6
- Published: May 2, 2025
- Affected: from 1.10.0, fixed in 1.19.1.

### [CVE-2025-4166](https://cve.now/CVE-2025-4166): Vault May Include Sensitive Data in Error Logs When Using the KV v2 Plugin

- Severity: Medium 4.5
- Published: May 2, 2025
- Affected: from 0.3.0, fixed in 1.19.3.

### [CVE-2024-8185](https://cve.now/CVE-2024-8185): Vault Vulnerable to Denial of Service When Processing Raft Join Requests

- Severity: High 7.5
- Published: Oct 31, 2024
- Affected: from 1.2.0, fixed in 1.18.1.

### [CVE-2024-9180](https://cve.now/CVE-2024-9180): Vault Operators in Root Namespace May Elevate Their Privileges

- Severity: High 7.2
- Published: Oct 10, 2024
- Affected: fixed in 1.18.0.

### [CVE-2024-7594](https://cve.now/CVE-2024-7594): Vault SSH Secrets Engine Configuration Did Not Restrict Valid Principals By Default

- Severity: High 7.5
- Published: Sep 26, 2024
- Affected: from 1.7.7, fixed in 1.17.6.

### [CVE-2024-8365](https://cve.now/CVE-2024-8365): Vault Leaks AppRole Client Tokens And Accessor in Audit Log

- Severity: Medium 6.2
- Published: Sep 2, 2024
- Affected: from 1.17.3, fixed in 1.17.5.

### [CVE-2024-6468](https://cve.now/CVE-2024-6468): Vault Vulnerable to Denial of Service When Setting a Proxy Protocol Behavior

- Severity: High 7.5
- Published: Jul 11, 2024
- Affected: from 1.10.0, fixed in 1.15.12; from 1.16.0-rc1, fixed in 1.16.3; from 1.17.0-rc1, fixed in 1.17.2; from 1.10.0, fixed in 1.16.3; from 1.17.0-rc1, fixed in 1.17.2.

### [CVE-2024-5798](https://cve.now/CVE-2024-5798): Vault Incorrectly Validated JSON Web Tokens (JWT) Audience Claims

- Severity: Low 2.6
- Published: Jun 12, 2024
- Affected: from 0.11.0, fixed in 1.16.3; from 1.17.0-rc1, fixed in 1.17.0; from 1.17.0-rc1, fixed in 1.17.0; from 1.16.0-rc1, fixed in 1.16.3; from 0.11.0, fixed in 1.15.9.

### [CVE-2024-2660](https://cve.now/CVE-2024-2660): Vault TLS Cert Auth Method Did Not Correctly Validate OCSP Responses

- Severity: Medium 6.4
- Published: Apr 4, 2024
- Affected: fixed in 1.16.0.

### [CVE-2024-2048](https://cve.now/CVE-2024-2048): Vault Cert Auth Method Did Not Correctly Validate Non-CA Certificates

- Severity: High 8.1
- Published: Mar 4, 2024
- Affected: from 1.15.0, fixed in 1.15.5; fixed in 1.14.10; fixed in 1.14.10; from 1.15.0, fixed in 1.15.5.

### [CVE-2024-0831](https://cve.now/CVE-2024-0831): Vault May Expose Sensitive Information When Configuring An Audit Log Device

- Severity: Medium 4.5
- Published: Feb 1, 2024
- Affected: from 1.15.0, fixed in 1.15.5.

### [CVE-2023-6337](https://cve.now/CVE-2023-6337): Vault May be Vulnerable to a Denial of Service Through Memory Exhaustion When Handling Large HTTP Requests

- Severity: High 7.5
- Published: Dec 8, 2023
- Affected: from 1.12.0, fixed in 1.13.12; from 1.14.0, fixed in 1.14.8; from 1.15.0, fixed in 1.15.4; from 1.15.0, fixed in 1.15.4; from 1.14.0, fixed in 1.14.8; from 1.12.0, fixed in 1.13.12.

### [CVE-2023-5954](https://cve.now/CVE-2023-5954): Vault Requests Triggering Policy Checks May Lead To Unbounded Memory Consumption

- Severity: Medium 5.9
- Published: Nov 9, 2023
- Affected: fixed in 1.13.10; from 1.14.0, fixed in 1.14.6; from 1.15.0, fixed in 1.15.2; fixed in 1.13.10; from 1.14.0, fixed in 1.14.6; from 1.15.0, fixed in 1.15.2.

### [CVE-2023-5077](https://cve.now/CVE-2023-5077): Vault's Google Cloud Secrets Engine Removed Existing IAM Conditions When Creating / Updating Rolesets

- Severity: High 7.6
- Published: Sep 28, 2023
- Affected: fixed in 1.13.0.

### [CVE-2023-4680](https://cve.now/CVE-2023-4680): Vault's Transit Secrets Engine Allowed Nonce Specified without Convergent Encryption

- Severity: Medium 6.8
- Published: Sep 14, 2023
- Affected: from 1.6.0, fixed in 1.12.11; from 1.13.0, fixed in 1.13.7; from 1.14.0, fixed in 1.14.3; from 1.6.0, fixed in 1.12.11; from 1.13.0, fixed in 1.13.7; from 1.14.0, fixed in 1.14.3.

### [CVE-2023-3462](https://cve.now/CVE-2023-3462): Vault's LDAP Auth Method Allows for User Enumeration

- Severity: Medium 5.3
- Published: Jul 31, 2023
- Affected: fixed in 1.13.5; from 1.14.0, fixed in 1.14.1; fixed in 1.13.5; from 1.14.0, fixed in 1.14.1.

### [CVE-2023-2121](https://cve.now/CVE-2023-2121): Vault’s KV Diff Viewer Allowed for HTML Injection

- Severity: Medium 4.3
- Published: Jun 9, 2023
- Affected: fixed in 1.11.11; from 1.12.0, fixed in 1.12.7; from 1.13.0, fixed in 1.13.3; fixed in 1.11.11; from 1.12.0, fixed in 1.12.7; from 1.13.0, fixed in 1.13.3.

### [CVE-2023-0620](https://cve.now/CVE-2023-0620): Vault Vulnerable to SQL Injection When Configuring the Microsoft SQL Database Storage Backend

- Severity: Medium 6.5
- Published: Mar 30, 2023
- Affected: from 0.8.0, fixed in 1.11.9; from 1.12.0, fixed in 1.12.5; from 1.13.0, fixed in 1.13.1; from 0.8.0, fixed in 1.11.9; from 1.12.0, fixed in 1.12.5; from 1.13.0, fixed in 1.13.1.

### [CVE-2023-0665](https://cve.now/CVE-2023-0665): Vault PKI Issuer Endpoint Did Not Correctly Authorize Access to Issuer Metadata

- Severity: Medium 6.5
- Published: Mar 30, 2023
- Affected: fixed in 1.11.9; from 1.12.0, fixed in 1.12.5; from 1.13.0, fixed in 1.13.1; fixed in 1.11.9; from 1.12.0, fixed in 1.12.5; from 1.13.0, fixed in 1.13.1.

### [CVE-2023-25000](https://cve.now/CVE-2023-25000): Vault Vulnerable to Cache-Timing Attacks During Seal and Unseal Operations

- Severity: Medium 5.0
- Published: Mar 30, 2023
- Affected: fixed in 1.11.9; from 1.12.0, fixed in 1.12.5; from 1.13.0, fixed in 1.13.1; fixed in 1.11.9; from 1.12.0, fixed in 1.12.5; from 1.13.0, fixed in 1.13.1.

### [CVE-2023-24999](https://cve.now/CVE-2023-24999): Vault Fails to Verify if the AppRole SecretID Belongs to Role During a Destroy Operation

- Severity: Medium 4.4
- Published: Mar 10, 2023
- Affected: fixed in 1.10.11; from 1.11.0, fixed in 1.11.8; from 1.12.0, fixed in 1.12.4; fixed in 1.10.11; from 1.11.0, fixed in 1.11.8; from 1.12.0, fixed in 1.12.4.

### [CVE-2022-41316](https://cve.now/CVE-2022-41316): HashiCorp Vault and Vault Enterprise’s TLS certificate auth method did not initially load the optionally configured CRL issued by the…

- Severity: Medium 5.3
- Published: Oct 12, 2022
- Affected: from 1.11.0, fixed in 1.11.4; from 1.10.0, fixed in 1.10.7; fixed in 1.9.10; fixed in 1.9.10; from 1.10.0, fixed in 1.10.7; from 1.11.0, fixed in 1.11.4.

### [CVE-2022-40186](https://cve.now/CVE-2022-40186): An issue was discovered in HashiCorp Vault and Vault Enterprise before 1.11.3.

- Severity: Critical 9.1
- Published: Sep 22, 2022
- Affected: from 1.11.0, fixed in 1.11.3; from 1.10.0, fixed in 1.10.6; from 1.8.0, fixed in 1.9.9; from 1.8.0, fixed in 1.9.9; from 1.10.0, fixed in 1.10.6; from 1.11.0, fixed in 1.11.3.

### [CVE-2022-30689](https://cve.now/CVE-2022-30689): HashiCorp Vault and Vault Enterprise from 1.10.0 to 1.10.2 did not correctly configure and enforce MFA on login after server restarts.

- Severity: Unrated
- Published: May 17, 2022
- Affected: from 1.10.0, fixed in 1.10.3.

### [CVE-2021-43998](https://cve.now/CVE-2021-43998): HashiCorp Vault and Vault Enterprise 0.11.0 up to 1.7.5 and 1.8.4 templated ACL policies would always match the first-created entity alias…

- Severity: Unrated
- Published: Nov 30, 2021
- Affected: from 0.11.0, fixed in 1.7.6; from 1.8.0, fixed in 1.8.5; from 0.11.0, fixed in 1.7.6; from 1.8.0, fixed in 1.8.5.

### [CVE-2021-42135](https://cve.now/CVE-2021-42135): HashiCorp Vault and Vault Enterprise 1.8.x through 1.8.4 may have an unexpected interaction between glob-related policies and the Google…

- Severity: Unrated
- Published: Oct 11, 2021
- Affected: from 1.8.0, through 1.8.4; from 1.8.0, fixed in 1.8.5.

### [CVE-2021-41802](https://cve.now/CVE-2021-41802): HashiCorp Vault and Vault Enterprise through 1.7.4 and 1.8.3 allowed a user with write permission to an entity alias ID sharing a mount…

- Severity: Low 2.9
- Published: Oct 8, 2021
- Affected: fixed in 1.7.5; from 1.8.0, fixed in 1.8.4; fixed in 1.7.5; from 1.8.0, fixed in 1.8.4.

### [CVE-2021-38553](https://cve.now/CVE-2021-38553): HashiCorp Vault and Vault Enterprise 1.4.0 through 1.7.3 initialized an underlying database file associated with the Integrated Storage…

- Severity: Unrated
- Published: Aug 13, 2021
- Affected: from 1.4.0, fixed in 1.8.0.

### [CVE-2021-38554](https://cve.now/CVE-2021-38554): HashiCorp Vault and Vault Enterprise’s UI erroneously cached and exposed user-viewed secrets between sessions in a single shared browser.

- Severity: Unrated
- Published: Aug 13, 2021
- Affected: fixed in 1.6.6; from 1.7.0, fixed in 1.7.4; fixed in 1.6.6; from 1.7.0, fixed in 1.7.4.

### [CVE-2021-32923](https://cve.now/CVE-2021-32923): HashiCorp Vault and Vault Enterprise allowed the renewal of nearly-expired token leases and dynamic secret leases (specifically, those…

- Severity: Unrated
- Published: Jun 3, 2021
- Affected: from 0.10.0, fixed in 1.5.9; from 1.6.0, fixed in 1.6.5; from 1.7.0, fixed in 1.7.2; from 1.7.0, fixed in 1.7.2; from 1.6.0, fixed in 1.6.5; from 0.10.0, fixed in 1.5.9.

### [CVE-2021-3282](https://cve.now/CVE-2021-3282): HashiCorp Vault Enterprise 1.6.0 & 1.6.1 allowed the \`remove-peer\` raft operator command to be executed against DR secondaries without…

- Severity: Unrated
- Published: Feb 1, 2021
- Affected: from 1.6.0, fixed in 1.6.2.

### [CVE-2020-35177](https://cve.now/CVE-2020-35177): HashiCorp Vault and Vault Enterprise 1.4.1 and newer allowed the enumeration of users via the LDAP auth method.

- Severity: Unrated
- Published: Dec 17, 2020
- Affected: from 1.5.0, fixed in 1.5.6; from 1.6.0, fixed in 1.6.1; from 1.5.0, fixed in 1.5.6; from 1.6.0, fixed in 1.6.1.

### [CVE-2020-25816](https://cve.now/CVE-2020-25816): HashiCorp Vault and Vault Enterprise versions 1.0 and newer allowed leases created with a batch token to outlive their TTL because…

- Severity: Unrated
- Published: Sep 30, 2020
- Affected: from 1.0.0-beta1, fixed in 1.5.4; from 1.0.0, fixed in 1.5.4.

### [CVE-2020-16251](https://cve.now/CVE-2020-16251): HashiCorp Vault and Vault Enterprise versions 0.8.3 and newer, when configured with the GCP GCE auth method, may be vulnerable to…

- Severity: Unrated
- Published: Aug 26, 2020
- Affected: from 0.8.3, fixed in 1.2.5; from 1.3.0, fixed in 1.3.8; from 1.4.0, fixed in 1.4.4; from 1.5.0, fixed in 1.5.1; from 0.8.3, fixed in 1.2.5; from 1.3.0, fixed in 1.3.8; from 1.4.0, fixed in 1.4.4; from 1.5.0, fixed in 1.5.1.

### [CVE-2020-16250](https://cve.now/CVE-2020-16250): HashiCorp Vault and Vault Enterprise versions 0.7.1 and newer, when configured with the AWS IAM auth method, may be vulnerable to…

- Severity: Unrated
- Published: Aug 26, 2020
- Affected: from 0.8.1, fixed in 1.2.5; from 1.3.0, fixed in 1.3.8; from 1.4.0, fixed in 1.4.4; from 1.5.0, fixed in 1.5.1; from 0.8.1, fixed in 1.2.5; from 1.3.0, fixed in 1.3.8; from 1.4.0, fixed in 1.4.4; from 1.5.0, fixed in 1.5.1.

### [CVE-2020-13223](https://cve.now/CVE-2020-13223): HashiCorp Vault and Vault Enterprise logged proxy environment variables that potentially included sensitive credentials.

- Severity: Unrated
- Published: Jun 10, 2020
- Affected: from 1.3.0, fixed in 1.3.6; from 1.4.0, fixed in 1.4.2; from 1.3.0, fixed in 1.3.6; from 1.4.0, fixed in 1.4.2.

### [CVE-2020-10661](https://cve.now/CVE-2020-10661): HashiCorp Vault and Vault Enterprise versions 0.11.0 through 1.3.3 may, under certain circumstances, have existing nested-path policies…

- Severity: Unrated
- Published: Mar 23, 2020
- Affected: from 0.11.0, fixed in 1.3.4.

### [CVE-2020-10660](https://cve.now/CVE-2020-10660): HashiCorp Vault and Vault Enterprise versions 0.9.0 through 1.3.3 may, under certain circumstances, have an Entity's Group membership…

- Severity: Unrated
- Published: Mar 23, 2020
- Affected: from 0.9.0, fixed in 1.3.4.

### [CVE-2020-7220](https://cve.now/CVE-2020-7220): HashiCorp Vault Enterprise 0.11.0 through 1.3.1 fails, in certain circumstances, to revoke dynamic secrets for a mount in a deleted…

- Severity: Unrated
- Published: Jan 23, 2020
- Affected: from 0.11.0, fixed in 1.3.2.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/go/github.com/hashicorp/vault
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.