Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 251

Export CSV
CVE-2024-12678

Nomad Allocations Vulnerable To Privilege Escalation Within A Namespace Using Unredacted Workload Identity Tokens

Nomad Community and Nomad Enterprise ("Nomad") allocations are vulnerable to privilege escalation within a namespace through unredacted workload identity tokens. This vulnerability, identified as CVE-2024-12678, is fixed in Nomad Community Edition 1.9.4 and Nomad Enterprise 1.9.4, 1.8.8, and 1.7.16.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Hashicorp
Products
Nomad
CVE-2024-3817

HashiCorp go-getter Vulnerable to Argument Injection When Fetching Remote Default Git Branches

HashiCorp’s go-getter library is vulnerable to argument injection when executing Git to discover remote branches. This vulnerability does not affect the go-getter/v2 branch and package.

CVSS 3.1 · 9.8 Critical EPSS 1.3% KEV · Not listed
Vendors
Hashicorp
Products
Go-getter
CVE-2024-6257

HashiCorp go-getter Vulnerable to Code Execution On Git Update Via Git Config Manipulation

HashiCorp’s go-getter library can be coerced into executing Git update on an existing maliciously modified Git Configuration, potentially leading to arbitrary code execution.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Hashicorp
Products
Go-getter
CVE-2025-8959

HashiCorp go-getter Vulnerable to Arbitrary Read through Symlink Attack

HashiCorp's go-getter library subdirectory download feature is vulnerable to symlink attacks leading to unauthorized read access beyond the designated directory boundaries. This vulnerability, identified as CVE-2025-8959, is fixed in go-getter 1.7.9.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Hashicorp
Products
Go-getter
CVE-2025-13432

Terraform Enterprise state versions can be created by users with specific permissions without sufficient write access

Terraform state versions can be created by a user with specific but insufficient permissions in a Terraform Enterprise workspace. This may allow for the alteration of infrastructure if a subsequent plan operation is approved by a user with approval permission or auto-applied. This vulnerability, CVE-2025-13432, is fixed in Terraform Enterprise version 1.1.1 and 1.0.3.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Hashicorp
Products
Terraform Terraform Enterprise
CVE-2024-2048

Vault Cert Auth Method Did Not Correctly Validate Non-CA Certificates

Vault and Vault Enterprise (“Vault”) TLS certificate auth method did not correctly validate client certificates when configured with a non-CA certificate as trusted certificate. In this configuration, an attacker may be able to craft a malicious certificate that could be used to bypass authentication. Fixed in Vault 1.15.5 and 1.14.10.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Hashicorp Openbao
Products
Vault Vault Enterprise Openbao
CVE-2024-7594

Vault SSH Secrets Engine Configuration Did Not Restrict Valid Principals By Default

Vault’s SSH secrets engine did not require the valid_principals list to contain a value by default. If the valid_principals and default_user fields of the SSH secrets engine configuration are not set, an SSH certificate requested by an authorized user to Vault’s SSH secrets engine could be used to authenticate as any user on the host. Fixed in Vault Community Edition 1.17.6, and in Vault Enterprise 1.17.6, 1.16.10, and 1.15.15.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Hashicorp Openbao
Products
Vault Vault Community Edition Vault Enterprise and 1 more
CVE-2024-8185

Vault Vulnerable to Denial of Service When Processing Raft Join Requests

Vault Community and Vault Enterprise (“Vault”) clusters using Vault’s Integrated Storage backend are vulnerable to a denial-of-service (DoS) attack through memory exhaustion through a Raft cluster join API endpoint . An attacker may send a large volume of requests to the endpoint which may cause Vault to consume excessive system memory resources, potentially leading to a crash of the underlying system and the Vault process itself. This vulnerability, CVE-2024-8185, is fixed in Vault Community 1.18.1 and Vault Enterprise 1.18.1, 1.17.8, and 1.16.12.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Hashicorp Openbao
Products
Vault Openbao
CVE-2024-5798

Vault Incorrectly Validated JSON Web Tokens (JWT) Audience Claims

Vault and Vault Enterprise did not properly validate the JSON Web Token (JWT) role-bound audience claim when using the Vault JWT auth method. This may have resulted in Vault validating a JWT the audience and role-bound claims do not match, allowing an invalid login to succeed when it should have been rejected. This vulnerability, CVE-2024-5798, was fixed in Vault and Vault Enterprise 1.17.0, 1.16.3, and 1.15.9

CVSS 3.1 · 2.6 Low EPSS < 1% KEV · Not listed
Vendors
Hashicorp
Products
Vault Vault Enterprise
CVE-2025-6004

Vault Userpass and LDAP User Lockout Bypass

Vault and Vault Enterprise’s (“Vault”) user lockout feature could be bypassed for Userpass and LDAP authentication methods. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Hashicorp
Products
Vault Vault Enterprise
CVE-2025-6011

Timing Side-Channel in Vault’s Userpass Auth Method

A timing side channel in Vault and Vault Enterprise’s (“Vault”) userpass auth method allowed an attacker to distinguish between existing and non-existing users, and potentially enumerate valid usernames for Vault’s Userpass auth method. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Hashicorp
Products
Vault Vault Enterprise
CVE-2025-6014

Vault TOTP Secrets Engine Code Reuse

Vault and Vault Enterprise’s (“Vault”) TOTP Secrets Engine code validation endpoint is susceptible to code reuse within its validity period. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Hashicorp
Products
Vault Vault Enterprise
CVE-2025-6015

Vault Login MFA Bypass of Rate Limiting and TOTP Code Reuse

Vault and Vault Enterprise’s (“Vault”) login MFA rate limits could be bypassed and TOTP tokens could be reused. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23.

CVSS 3.1 · 5.7 Medium EPSS < 1% KEV · Not listed
Vendors
Hashicorp
Products
Vault Vault Enterprise
CVE-2025-5999

Vault Root Namespace Operator May Elevate Token Privileges

A privileged Vault operator with write permissions to the root namespace’s identity endpoint could escalate their own or another user’s token privileges to Vault’s root policy. Fixed in Vault Community Edition 1.20.0 and Vault Enterprise 1.20.0, 1.19.6, 1.18.11 and 1.16.22.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Hashicorp
Products
Vault
CVE-2025-6000

Arbitrary Remote Code Execution via Plugin Catalog Abuse

A privileged Vault operator within the root namespace with write permission to {{sys/audit}} may obtain code execution on the underlying host if a plugin directory is set in Vault’s configuration. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Hashicorp
Products
Vault Vault Enterprise
CVE-2025-4656

Vault Vulnerable to Recovery Key Cancellation Denial of Service

Vault Community and Vault Enterprise rekey and recovery key operations can lead to a denial of service due to uncontrolled cancellation by a Vault operator. This vulnerability (CVE-2025-4656) has been remediated in Vault Community Edition 1.20.0 and Vault Enterprise 1.20.0, 1.19.6, 1.18.11, 1.17.17, and 1.16.22.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed
Vendors
Hashicorp
Products
Vault
CVE-2024-6468

Vault Vulnerable to Denial of Service When Setting a Proxy Protocol Behavior

Vault and Vault Enterprise did not properly handle requests originating from unauthorized IP addresses when the TCP listener option, proxy_protocol_behavior, was set to deny_unauthorized. When receiving a request from a source IP address that was not listed in proxy_protocol_authorized_addrs, the Vault API server would shut down and no longer respond to any HTTP requests, potentially resulting in denial of service. While this bug also affected versions of Vault up to 1.17.1 and 1.16.5, a separate regression in those release series did not allow Vault operators to configure the deny_unauthorized option, thus not allowing the conditions for the denial of service to occur. Fixed in Vault and Vault Enterprise 1.17.2, 1.16.6, and 1.15.12.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Hashicorp
Products
Vault Vault Enterprise
CVE-2025-3879

Vault’s Azure Authentication Method bound_location Restriction Could be Bypassed on Login

Vault Community, Vault Enterprise (“Vault”) Azure Auth method did not correctly validate the claims in the Azure-issued token, resulting in the potential bypass of the bound_locations parameter on login. Fixed in Vault Community Edition 1.19.1 and Vault Enterprise 1.19.1, 1.18.7, 1.17.14, 1.16.18.

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed
Vendors
Hashicorp
Products
Vault Vault Enterprise
CVE-2024-2660

Vault TLS Cert Auth Method Did Not Correctly Validate OCSP Responses

Vault and Vault Enterprise TLS certificates auth method did not correctly validate OCSP responses when one or more OCSP sources were configured. This vulnerability, CVE-2024-2660, affects Vault and Vault Enterprise 1.14.0 and above, and is fixed in Vault 1.16.0 and Vault Enterprise 1.16.1, 1.15.7, and 1.14.11.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Hashicorp
Products
Vault Vault Enterprise
CVE-2024-2877

Vault Enterprise Leaks Sensitive HTTP Request Headers in the Audit Log When Deployed With a Performance Standby Node

Vault Enterprise, when configured with performance standby nodes and a configured audit device, will inadvertently log request headers on the standby node. These logs may have included sensitive HTTP request information in cleartext. This vulnerability, CVE-2024-2877, was fixed in Vault Enterprise 1.15.8.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Hashicorp
Products
Vault Vault Enterprise