CVE-2024-7594

Vault SSH Secrets Engine Configuration Did Not Restrict Valid Principals By Default

Vault’s SSH secrets engine did not require the valid_principals list to contain a value by default. If the valid_principals and default_user fields of the SSH secrets engine configuration are not set, an SSH certificate requested by an authorized user to Vault’s SSH secrets engine could be used to authenticate as any user on the host. Fixed in Vault Community Edition 1.17.6, and in Vault Enterprise 1.17.6, 1.16.10, and 1.15.15.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Hashicorp Openbao

Products

Vault Vault Community Edition Vault Enterprise and 1 more

CVE-2024-8185

Vault Vulnerable to Denial of Service When Processing Raft Join Requests

Vault Community and Vault Enterprise (“Vault”) clusters using Vault’s Integrated Storage backend are vulnerable to a denial-of-service (DoS) attack through memory exhaustion through a Raft cluster join API endpoint . An attacker may send a large volume of requests to the endpoint which may cause Vault to consume excessive system memory resources, potentially leading to a crash of the underlying system and the Vault process itself. This vulnerability, CVE-2024-8185, is fixed in Vault Community 1.18.1 and Vault Enterprise 1.18.1, 1.17.8, and 1.16.12.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Hashicorp Openbao

Products

Vault Openbao

CVE-2024-5798

Vault Incorrectly Validated JSON Web Tokens (JWT) Audience Claims

Vault and Vault Enterprise did not properly validate the JSON Web Token (JWT) role-bound audience claim when using the Vault JWT auth method. This may have resulted in Vault validating a JWT the audience and role-bound claims do not match, allowing an invalid login to succeed when it should have been rejected. This vulnerability, CVE-2024-5798, was fixed in Vault and Vault Enterprise 1.17.0, 1.16.3, and 1.15.9

CVSS 3.1 · 2.6 Low EPSS < 1% KEV · Not listed

Vendors

Hashicorp

Products

Vault Vault Enterprise

CVE-2025-6004

Vault Userpass and LDAP User Lockout Bypass

Vault and Vault Enterprise’s (“Vault”) user lockout feature could be bypassed for Userpass and LDAP authentication methods. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Hashicorp

Products

Vault Vault Enterprise

CVE-2025-6011

Timing Side-Channel in Vault’s Userpass Auth Method

A timing side channel in Vault and Vault Enterprise’s (“Vault”) userpass auth method allowed an attacker to distinguish between existing and non-existing users, and potentially enumerate valid usernames for Vault’s Userpass auth method. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Hashicorp

Products

Vault Vault Enterprise

CVE-2025-6014

Vault TOTP Secrets Engine Code Reuse

Vault and Vault Enterprise’s (“Vault”) TOTP Secrets Engine code validation endpoint is susceptible to code reuse within its validity period. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Hashicorp

Products

Vault Vault Enterprise

CVE-2025-6015

Vault Login MFA Bypass of Rate Limiting and TOTP Code Reuse

Vault and Vault Enterprise’s (“Vault”) login MFA rate limits could be bypassed and TOTP tokens could be reused. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23.

CVSS 3.1 · 5.7 Medium EPSS < 1% KEV · Not listed

Vendors

Hashicorp

Products

Vault Vault Enterprise

CVE-2025-5999

Vault Root Namespace Operator May Elevate Token Privileges

A privileged Vault operator with write permissions to the root namespace’s identity endpoint could escalate their own or another user’s token privileges to Vault’s root policy. Fixed in Vault Community Edition 1.20.0 and Vault Enterprise 1.20.0, 1.19.6, 1.18.11 and 1.16.22.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Hashicorp

Products

Vault

CVE-2025-6000

Arbitrary Remote Code Execution via Plugin Catalog Abuse

A privileged Vault operator within the root namespace with write permission to {{sys/audit}} may obtain code execution on the underlying host if a plugin directory is set in Vault’s configuration. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Hashicorp

Products

Vault Vault Enterprise

CVE-2025-4656

Vault Vulnerable to Recovery Key Cancellation Denial of Service

Vault Community and Vault Enterprise rekey and recovery key operations can lead to a denial of service due to uncontrolled cancellation by a Vault operator. This vulnerability (CVE-2025-4656) has been remediated in Vault Community Edition 1.20.0 and Vault Enterprise 1.20.0, 1.19.6, 1.18.11, 1.17.17, and 1.16.22.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed

Vendors

Hashicorp

Products

Vault

CVE-2024-6468

Vault Vulnerable to Denial of Service When Setting a Proxy Protocol Behavior

Vault and Vault Enterprise did not properly handle requests originating from unauthorized IP addresses when the TCP listener option, proxy_protocol_behavior, was set to deny_unauthorized. When receiving a request from a source IP address that was not listed in proxy_protocol_authorized_addrs, the Vault API server would shut down and no longer respond to any HTTP requests, potentially resulting in denial of service. While this bug also affected versions of Vault up to 1.17.1 and 1.16.5, a separate regression in those release series did not allow Vault operators to configure the deny_unauthorized option, thus not allowing the conditions for the denial of service to occur. Fixed in Vault and Vault Enterprise 1.17.2, 1.16.6, and 1.15.12.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Hashicorp

Products

Vault Vault Enterprise

CVE-2025-3879

Vault’s Azure Authentication Method bound_location Restriction Could be Bypassed on Login

Vault Community, Vault Enterprise (“Vault”) Azure Auth method did not correctly validate the claims in the Azure-issued token, resulting in the potential bypass of the bound_locations parameter on login. Fixed in Vault Community Edition 1.19.1 and Vault Enterprise 1.19.1, 1.18.7, 1.17.14, 1.16.18.

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed

Vendors

Hashicorp

Products

Vault Vault Enterprise

CVE-2024-2660

Vault TLS Cert Auth Method Did Not Correctly Validate OCSP Responses

Vault and Vault Enterprise TLS certificates auth method did not correctly validate OCSP responses when one or more OCSP sources were configured. This vulnerability, CVE-2024-2660, affects Vault and Vault Enterprise 1.14.0 and above, and is fixed in Vault 1.16.0 and Vault Enterprise 1.16.1, 1.15.7, and 1.14.11.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Hashicorp

Products

Vault Vault Enterprise

CVE-2024-2877

Vault Enterprise Leaks Sensitive HTTP Request Headers in the Audit Log When Deployed With a Performance Standby Node

Vault Enterprise, when configured with performance standby nodes and a configured audit device, will inadvertently log request headers on the standby node. These logs may have included sensitive HTTP request information in cleartext. This vulnerability, CVE-2024-2877, was fixed in Vault Enterprise 1.15.8.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Hashicorp

Products

Vault Vault Enterprise

CVE-2022-40186

vault: Vault Entity Alias Metadata May Leak Between Aliases With The Same Name Assigned To The Same Entity

An issue was discovered in HashiCorp Vault and Vault Enterprise before 1.11.3. A vulnerability in the Identity Engine was found where, in a deployment where an entity has multiple mount accessors with shared alias names, Vault may overwrite metadata to the wrong alias due to an issue with checking the proper alias assigned to an entity. This may allow for unintended access to key/value paths using that metadata in Vault.

CVSS 3.1 · 9.1 Critical EPSS 1.0% KEV · Not listed

Vendors

Hashicorp Redhat

Products

Vault Openshift Data Foundation

CVE-2022-41316

vault: insufficient certificate revocation list checking

HashiCorp Vault and Vault Enterprise’s TLS certificate auth method did not initially load the optionally configured CRL issued by the role's CA into memory on startup, resulting in the revocation list not being checked if the CRL has not yet been retrieved. Fixed in 1.12.0, 1.11.4, 1.10.7, and 1.9.10.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Hashicorp Redhat

Products

Vault Openshift Openshift Data Foundation

CVE-2023-24999

Vault Fails to Verify if the AppRole SecretID Belongs to Role During a Destroy Operation

HashiCorp Vault and Vault Enterprise’s approle auth method allowed any authenticated user with access to an approle destroy endpoint to destroy the secret ID of any other role by providing the secret ID accessor. This vulnerability is fixed in Vault 1.13.0, 1.12.4, 1.11.8, 1.10.11 and above.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed

Vendors

Hashicorp Redhat

Products

Vault Openshift Data Foundation

CVE-2023-6337

Vault May be Vulnerable to a Denial of Service Through Memory Exhaustion When Handling Large HTTP Requests

HashiCorp Vault and Vault Enterprise 1.12.0 and newer are vulnerable to a denial of service through memory exhaustion of the host when handling large unauthenticated and authenticated HTTP requests from a client. Vault will attempt to map the request to memory, resulting in the exhaustion of available memory on the host, which may cause Vault to crash. Fixed in Vault 1.15.4, 1.14.8, 1.13.12.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Hashicorp

Products

Vault

CVE-2024-0831

Vault May Expose Sensitive Information When Configuring An Audit Log Device

Vault and Vault Enterprise (“Vault”) may expose sensitive information when enabling an audit device which specifies the `log_raw` option, which may log sensitive information to other audit devices, regardless of whether they are configured to use `log_raw`.

CVSS 3.1 · 4.5 Medium EPSS < 1% KEV · Not listed

Vendors

Hashicorp

Products

Vault

CVE-2023-5954

Vault Requests Triggering Policy Checks May Lead To Unbounded Memory Consumption

HashiCorp Vault and Vault Enterprise inbound client requests triggering a policy check can lead to an unbounded consumption of memory. A large number of these requests may lead to denial-of-service. Fixed in Vault 1.15.2, 1.14.6, and 1.13.10.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Hashicorp Redhat

Products

Vault Openshift Openshift Data Foundation