hashicorp vault · threatengine.sh

Home/Product/hashicorp vault

Product

hashicorp vault

80 known vulnerabilities across versions

Vulnerabilities are listed by affected version. Select any CVE for the full briefing and its intelligence graph.

Sort Min CVSS Published since

Vault is vulnerable to a denial-of-service condition where an unauthenticated attacker can repeatedly initiate or cancel root toke

>= 1.14.0 and < 2.0.0

Vault’s PKI engine’s ACME validation did not reject local targets when issuing http-01 and tls-alpn-01 challenges. This may le

>= 0.11.2 and < 2.0.0

If a Vault auth mount is configured to pass through the "Authorization" header, and the "Authorization" header is used to authenti

>= 0.10.0 and < 2.0.0

An authenticated user with access to a kvv2 path through a policy containing a glob may be able to delete secrets they were not au

<= 371.v884a_4dd60fb_6

Jenkins HashiCorp Vault Plugin 371.v884a_4dd60fb_6 and earlier does not set the appropriate context for Vault credentials lookup,

>= 1.20.3 and < 1.21.0

Vault and Vault Enterprise (“Vault”) are vulnerable to an unauthenticated denial of service when processing JSON payloads. Thi

>= 0.6.0 and < 1.21.0

Vault and Vault Enterprise’s (“Vault”) AWS Auth method may be susceptible to authentication bypass if the role of the config

>= 1.15.0 and < 1.21.0

A malicious user may submit a specially-crafted complex payload that otherwise meets the default request size limit which results

>= 1.10.0 and < 1.20.2

Vault and Vault Enterprise’s (“Vault”) ldap auth method may not have correctly enforced MFA if username_as_alias was set to

Vault and Vault Enterprise (“Vault”) TLS certificate auth method did not correctly validate client certificates when configure

>= 1.10.0 and < 1.20.1

Vault and Vault Enterprise’s (“Vault”) login MFA rate limits could be bypassed and TOTP tokens could be reused. Fixed in Vau

Vault and Vault Enterprise’s (“Vault”) TOTP Secrets Engine code validation endpoint is susceptible to code reuse within its

A timing side channel in Vault and Vault Enterprise’s (“Vault”) userpass auth method allowed an attacker to distinguish betw

>= 1.13.0 and < 1.20.1

Vault and Vault Enterprise’s (“Vault”) user lockout feature could be bypassed for Userpass and LDAP authentication methods.

>= 0.8.0 and < 1.20.1

A privileged Vault operator within the root namespace with write permission to {{sys/audit}} may obtain code execution on the unde

>= 0.10.4 and < 1.20.0

A privileged Vault operator with write permissions to the root namespace’s identity endpoint could escalate their own or another

>= 1.14.8 and < 1.20.0

Vault Community and Vault Enterprise rekey and recovery key operations can lead to a denial of service due to uncontrolled cancell

>= 0.10.0 and < 1.19.1

Vault Community, Vault Enterprise (“Vault”) Azure Auth method did not correctly validate the claims in the Azure-issued token,

>= 0.3.0 and < 1.19.3

Vault Community and Vault Enterprise Key/Value (kv) Version 2 plugin may unintentionally expose sensitive information in server an

>= 1.2.0 and < 1.18.1

Vault Community and Vault Enterprise (“Vault”) clusters using Vault’s Integrated Storage backend are vulnerable to a denial-

>= 1.7.7 and < 1.18.0

A privileged Vault operator with write permissions to the root namespace’s identity endpoint could escalate their own or another

>= 1.7.7 and < 1.17.6

Vault’s SSH secrets engine did not require the valid_principals list to contain a value by default. If the valid_principals and

Vault Community Edition and Vault Enterprise experienced a regression where functionality that HMAC’d sensitive headers in the c

>= 1.10.0 and < 1.15.12

Vault and Vault Enterprise did not properly handle requests originating from unauthorized IP addresses when the TCP listener optio

>= 0.11.0 and < 1.15.9

Vault and Vault Enterprise did not properly validate the JSON Web Token (JWT) role-bound audience claim when using the Vault JWT a

>= 1.15.0 and < 1.15.8

Vault Enterprise, when configured with performance standby nodes and a configured audit device, will inadvertently log request hea

>= 1.14.0 and < 1.16.0

Vault and Vault Enterprise TLS certificates auth method did not correctly validate OCSP responses when one or more OCSP sources we

Vault and Vault Enterprise (“Vault”) TLS certificate auth method did not correctly validate client certificates when configure

>= 1.15.0 and < 1.15.5

Vault and Vault Enterprise (“Vault”) may expose sensitive information when enabling an audit device which specifies the `log_r

HashiCorp Vault and Vault Enterprise 1.12.0 and newer are vulnerable to a denial of service through memory exhaustion of the host

>= 1.13.7 and < 1.13.10

HashiCorp Vault and Vault Enterprise inbound client requests triggering a policy check can lead to an unbounded consumption of mem

>= 0.10.0 and < 1.13.0

The Vault and Vault Enterprise ("Vault") Google Cloud secrets engine did not preserve existing Google Cloud IAM Conditions upon cr

>= 0.11.0 and < 1.13.8

A Vault Enterprise Sentinel Role Governing Policy created by an operator to restrict access to resources in one namespace can be a

>= 1.6.0 and < 1.12.11

HashiCorp Vault and Vault Enterprise transit secrets engine allowed authorized users to specify arbitrary nonces, even with conver

>= 1.13.0 and < 1.13.5

HashiCorp's Vault and Vault Enterprise are vulnerable to user enumeration when using the LDAP auth method. An attacker may submit

An unhandled error in Vault Enterprise's namespace creation may cause the Vault process to crash, potentially resulting in denial

Vault and Vault Enterprise's (Vault) key-value v2 (kv-v2) diff viewer allowed HTML injection into the Vault web UI through key val

<= 360.v0a_1c04cf807d

Jenkins HashiCorp Vault Plugin 360.v0a_1c04cf807d and earlier does not properly mask (i.e., replace with asterisks) credentials in

>= 1.13.0 and < 1.13.2

HashiCorp Vault Enterprise 1.13.0 up to 1.13.1 is vulnerable to a padding oracle attack when using an HSM in conjunction with the�

HashiCorp Vault's implementation of Shamir's secret sharing used precomputed table lookups, and was vulnerable to cache-timing att

HashiCorp Vault's PKI mount issuer endpoints did not correctly authorize access to remove an issuer or modify issuer metadata, pot

HashiCorp Vault and Vault Enterprise versions 0.8.0 through 1.13.1 are vulnerable to an SQL injection attack when configuring the

HashiCorp Vault and Vault Enterprise’s approle auth method allowed any authenticated user with access to an approle destroy endp

HashiCorp Vault and Vault Enterprise’s TLS certificate auth method did not initially load the optionally configured CRL issued b

>= 1.8.0 and < 1.9.9

An issue was discovered in HashiCorp Vault and Vault Enterprise before 1.11.3. A vulnerability in the Identity Engine was found wh

<= 354.vdb_858fd6b_f48

A missing permission check in Jenkins HashiCorp Vault Plugin 354.vdb_858fd6b_f48 and earlier allows attackers with Overall/Read pe

>= 1.7.0 and <= 1.9.7

HashiCorp Vault Enterprise 1.7.0 through 1.9.7, 1.10.4, and 1.11.0 clusters using Integrated Storage expose an unauthenticated API

>= 1.10.0 and < 1.10.3

HashiCorp Vault and Vault Enterprise from 1.10.0 to 1.10.2 did not correctly configure and enforce MFA on login after server resta

>= 1.7.0 and < 1.7.10

Vault Enterprise clusters using the tokenization transform feature can expose the tokenization key through the tokenization key co

>= 1.8.0 and < 1.8.9

"Vault and Vault Enterprise 1.8.0 through 1.8.8, and 1.9.3 allowed the PKI secrets engine under certain configurations to issue wi

<= 336.v182c0fbaaeb7

Jenkins HashiCorp Vault Plugin 336.v182c0fbaaeb7 and earlier implements functionality that allows agent processes to read arbitrar

Jenkins HashiCorp Vault Plugin 3.8.0 and earlier implements functionality that allows agent processes to retrieve any Vault secret

Jenkins HashiCorp Vault Plugin 3.7.0 and earlier does not mask Vault credentials in Pipeline build logs or in Pipeline step descri

>= 1.4.0 and < 1.7.7

In HashiCorp Vault and Vault Enterprise before 1.7.7, 1.8.x before 1.8.6, and 1.9.x before 1.9.1, clusters using the Integrated St

>= 0.11.0 and <= 1.7.5

HashiCorp Vault and Vault Enterprise 0.11.0 up to 1.7.5 and 1.8.4 templated ACL policies would always match the first-created enti

>= 1.8.0 and <= 1.8.4

HashiCorp Vault and Vault Enterprise 1.8.x through 1.8.4 may have an unexpected interaction between glob-related policies and the

HashiCorp Vault and Vault Enterprise through 1.7.4 and 1.8.3 allowed a user with write permission to an entity alias ID sharing a

>= 0.9.2 and < 1.6.3

HashiCorp Vault Enterprise 0.9.2 through 1.6.2 allowed the read of license metadata from DR secondaries without authentication. Fi

HashiCorp Vault and Vault Enterprise’s UI erroneously cached and exposed user-viewed secrets between sessions in a single shared

>= 1.4.0 and < 1.8.0

HashiCorp Vault and Vault Enterprise 1.4.0 through 1.7.3 initialized an underlying database file associated with the Integrated St

>= 0.10.0 and < 1.5.9

HashiCorp Vault and Vault Enterprise allowed the renewal of nearly-expired token leases and dynamic secret leases (specifically, t

>= 0.1.0 and < 2.2.0

HashiCorp vault-action (aka Vault GitHub Action) before 2.2.0 allows attackers to obtain sensitive information from log files beca

>= 1.5.1 and < 1.5.8

HashiCorp Vault and Vault Enterprise 1.5.1 and newer, under certain circumstances, may exclude revoked but unexpired certificates

HashiCorp Vault and Vault Enterprise Cassandra integrations (storage backend and database secrets engine plugin) did not validate

HashiCorp Vault Enterprise 1.6.0 & 1.6.1 allowed the remove-peer raft operator command to be executed against DR secondaries wit

HashiCorp Vault and Vault Enterprise disclosed the internal IP address of the Vault node when responding to some invalid, unauthen

HashiCorp Vault and Vault Enterprise allowed for enumeration of Secrets Engine mount paths via unauthenticated HTTP requests. Fixe

>= 1.5.0 and < 1.5.6

HashiCorp Vault Enterprise’s Sentinel EGP policy feature incorrectly allowed requests to be processed in parent and sibling name

>= 1.5.0 and < 1.5.6

HashiCorp Vault and Vault Enterprise 1.4.1 and newer allowed the enumeration of users via the LDAP auth method. Fixed in 1.5.6 and

>= 0.6.0 and < 0.11.6

The official vault docker images before 0.11.6 contain a blank password for a root user. System using the vault docker container d

>= 1.0.0 and < 1.4.7

HashiCorp Vault and Vault Enterprise versions 1.0 and newer allowed leases created with a batch token to outlive their TTL because

>= 0.8.3 and < 1.2.5

HashiCorp Vault and Vault Enterprise versions 0.8.3 and newer, when configured with the GCP GCE auth method, may be vulnerable to

>= 0.7.1 and < 1.2.5

HashiCorp Vault and Vault Enterprise versions 0.7.1 and newer, when configured with the AWS IAM auth method, may be vulnerable to

HashiCorp vault-ssh-helper up to and including version 0.1.6 incorrectly accepted Vault-issued SSH OTPs for the subnet in which a

HashiCorp Vault and Vault Enterprise logged proxy environment variables that potentially included sensitive credentials. Fixed in

>= 1.4.0 and < 1.4.2

HashiCorp Vault and Vault Enterprise 1.4.0 and 1.4.1, when configured with the GCP Secrets Engine, may incorrectly generate GCP Cr

>= 0.11.0 and <= 1.3.3

HashiCorp Vault and Vault Enterprise versions 0.11.0 through 1.3.3 may, under certain circumstances, have existing nested-path pol

>= 0.9.0 and <= 1.3.3

HashiCorp Vault and Vault Enterprise versions 0.9.0 through 1.3.3 may, under certain circumstances, have an Entity's Group members

>= 0.11.0 and < 1.3.2

HashiCorp Vault Enterprise 0.11.0 through 1.3.1 fails, in certain circumstances, to revoke dynamic secrets for a mount in a delete

HashiCorp Vault before 1.0.0 writes the master key to the server log in certain unusual or misconfigured scenarios in which incorr

Vulnerabilities
CISA KEV catalog
CWE weaknesses
CAPEC attack patterns
Package vulnerabilities

Threat intelligence
Threat actors
Tools & malware
ATT&CK techniques
IOCs

Detection & defense
Sigma rules
YARA rules
Atomic Red Team tests
D3FEND countermeasures

Compliance
NIST 800-53
ISO 27001:2022
SOC 2 TSC
PCI-DSS v4.0
CIS Controls v8.1

About
All capabilities
Live statistics
Data sources
Privacy policy
Terms of service

threatengine.sh · Open-source threat intelligence platform · 100+ authoritative sources · Every fact traces to its origin