Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
49 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Vault and Vault Enterprise ("Vault") are vulnerable to an unauthenticated denial of service when processing JSON payloads. This occurs due to a regression from a previous fix for [+HCSEC-2025-24+|https://discuss.hashicorp.com/t/hcsec-2025-24-vault-denial-of-service-though-complex-json-payloads/76393] which allowed for processing JSON payloads before applying rate limits. This vulnerability, CVE-2025-12044, is fixed in Vault Community Edition 1.21.0 and Vault Enterprise 1.16.27, 1.19.11, 1.20.5, and 1.21.0.
Recommended action: Upgrade to 1.21.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Vault and Vault Enterprise's ("Vault") AWS Auth method may be susceptible to authentication bypass if the role of the configured boundprincipaliam is the same across AWS accounts, or uses a wildcard. This vulnerability is fixed in Vault Community Edition 1.21.0 and Vault Enterprise 1.21.0, 1.20.5, 1.19.11, and 1.16.27.
Recommended action: Upgrade to 1.21.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A malicious user may submit a specially-crafted complex payload that otherwise meets the default request size limit which results in excessive memory and CPU consumption of Vault. This may lead to a timeout in Vault’s auditing subroutine, potentially resulting in the Vault server to become unresponsive. This vulnerability, CVE-2025-6203, is fixed in Vault Community Edition 1.20.3 and Vault Enterprise 1.20.3, 1.19.9, 1.18.14, and 1.16.25.
Recommended action: Upgrade to 1.20.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Vault and Vault Enterprise’s (“Vault”) ldap auth method may not have correctly enforced MFA if usernameasalias was set to true and a user had multiple CNs that are equal but with leading or trailing spaces. Fixed in Vault Community Edition 1.20.2 and Vault Enterprise 1.20.2, 1.19.8, 1.18.13, and 1.16.24.
Recommended action: Upgrade to 1.20.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A privileged Vault operator within the root namespace with write permission to {{sys/audit}} may obtain code execution on the underlying host if a plugin directory is set in Vault’s configuration. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23.
Recommended action: Upgrade to 1.20.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Vault and Vault Enterprise’s (“Vault”) user lockout feature could be bypassed for Userpass and LDAP authentication methods. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23.
Recommended action: Upgrade to 1.20.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Vault and Vault Enterprise’s (“Vault”) TOTP Secrets Engine code validation endpoint is susceptible to code reuse within its validity period. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23.
Recommended action: Upgrade to 1.20.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Vault and Vault Enterprise (“Vault”) TLS certificate auth method did not correctly validate client certificates when configured with a non-CA certificate as [+trusted certificate+|https://developer.hashicorp.com/vault/api-docs/auth/cert#certificate]. In this configuration, an attacker may be able to craft a malicious certificate that could be used to impersonate another user. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23.
Recommended action: Upgrade to 1.20.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A privileged Vault operator with write permissions to the root namespace’s identity endpoint could escalate their own or another user’s token privileges to Vault’s root policy. Fixed in Vault Community Edition 1.20.0 and Vault Enterprise 1.20.0, 1.19.6, 1.18.11 and 1.16.22.
Recommended action: Upgrade to 1.20.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A timing side channel in Vault and Vault Enterprise’s (“Vault”) userpass auth method allowed an attacker to distinguish between existing and non-existing users, and potentially enumerate valid usernames for Vault’s Userpass auth method. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23.
Recommended action: Upgrade to 1.20.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Vault and Vault Enterprise’s (“Vault”) login MFA rate limits could be bypassed and TOTP tokens could be reused. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23.
Recommended action: Upgrade to 1.20.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Vault Community and Vault Enterprise rekey and recovery key operations can lead to a denial of service due to uncontrolled cancellation by a Vault operator. This vulnerability (CVE-2025-4656) has been remediated in Vault Community Edition 1.20.0 and Vault Enterprise 1.20.0, 1.19.6, 1.18.11, 1.17.17, and 1.16.22.
Recommended action: Upgrade to 1.20.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Vault Community, Vault Enterprise (“Vault”) Azure Auth method did not correctly validate the claims in the Azure-issued token, resulting in the potential bypass of the boundlocations parameter on login. Fixed in Vault Community Edition 1.19.1 and Vault Enterprise 1.19.1, 1.18.7, 1.17.14, 1.16.18.
Recommended action: Upgrade to 1.19.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Vault Community and Vault Enterprise Key/Value (kv) Version 2 plugin may unintentionally expose sensitive information in server and audit logs when users submit malformed payloads during secret creation or update operations via the Vault REST API. This vulnerability, identified as CVE-2025-4166, is fixed in Vault Community 1.19.3 and Vault Enterprise 1.19.3, 1.18.9, 1.17.16, 1.16.20.
Recommended action: Upgrade to 1.19.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Vault Community and Vault Enterprise (“Vault”) clusters using Vault’s Integrated Storage backend are vulnerable to a denial-of-service (DoS) attack through memory exhaustion through a Raft cluster join API endpoint. An attacker may send a large volume of requests to the endpoint which may cause Vault to consume excessive system memory resources, potentially leading to a crash of the underlying system and the Vault process itself. This vulnerability, CVE-2024-8185, is fixed in Vault Community 1.18.1 and Vault Enterprise 1.18.1, 1.17.8, and 1.16.12.
Recommended action: Upgrade to 1.18.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A privileged Vault operator with write permissions to the root namespace’s identity endpoint could escalate their privileges to Vault’s root policy. Fixed in Vault Community Edition 1.18.0 and Vault Enterprise 1.18.0, 1.17.7, 1.16.11, and 1.15.16
Recommended action: Upgrade to 1.18.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Vault Community Edition and Vault Enterprise experienced a regression where functionality that HMAC’d sensitive headers in the configured audit device, specifically client tokens and token accessors, was removed. This resulted in the plaintext values of client tokens and token accessors being stored in the audit log. This vulnerability, CVE-2024-8365, was fixed in Vault Community Edition and Vault Enterprise 1.17.5 and Vault Enterprise 1.16.9.
Recommended action: Upgrade to 1.17.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Vault and Vault Enterprise did not properly handle requests originating from unauthorized IP addresses when the TCP listener option, proxyprotocolbehavior, was set to denyunauthorized. When receiving a request from a source IP address that was not listed in proxyprotocolauthorizedaddrs, the Vault API server would shut down and no longer respond to any HTTP requests, potentially resulting in denial of service. While this bug also affected versions of Vault up to 1.17.1 and 1.16.5, a separate regression in those release series did not allow Vault operators to configure the denyunauthorized option, thus not allowing the conditions for the denial of service to occur. Fixed in Vault and Vault Enterprise 1.17.2, 1.16.6, and 1.15.12
Recommended action: Upgrade to 1.17.2, 1.16.3 or 1.15.12 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Vault and Vault Enterprise did not properly validate the JSON Web Token (JWT) role-bound audience claim when using the Vault JWT auth method. This may have resulted in Vault validating a JWT the audience and role-bound claims do not match, allowing an invalid login to succeed when it should have been rejected. This vulnerability, CVE-2024-5798, was fixed in Vault and Vault Enterprise 1.17.0, 1.16.3, and 1.15.9
Recommended action: Upgrade to 1.17.0, 1.16.3 or 1.15.9 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Vault and Vault Enterprise TLS certificates auth method did not correctly validate OCSP responses when one or more OCSP sources were configured. Fixed in Vault 1.16.0 and Vault Enterprise 1.16.1, 1.15.7, and 1.14.11.
Recommended action: Upgrade to 1.16.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/hashicorp/vault >= 1.15.0, < 1.15.5; < 1.14.10
Fixed in
1.15.51.14.10· Vendor fix available
Issue
Vault and Vault Enterprise (“Vault”) TLS certificate auth method did not correctly validate client certificates when configured with a non-CA certificate as trusted certificate. In this configuration, an attacker may be able to craft a malicious certificate that could be used to bypass authentication. Fixed in Vault 1.15.5 and 1.14.10.
Recommended action: Upgrade to 1.15.5 or 1.14.10 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Vault and Vault Enterprise (“Vault”) may expose sensitive information when enabling an audit device which specifies the lograw option, which may log sensitive information to other audit devices, regardless of whether they are configured to use lograw
Recommended action: Upgrade to 1.15.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
HashiCorp Vault Enterprise 1.6.0 & 1.6.1 allowed the remove-peer raft operator command to be executed against DR secondaries without authentication. Fixed in 1.6.2.
Recommended action: Upgrade to 1.6.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/hashicorp/vault >= 1.5.0, < 1.5.6; >= 1.6.0, < 1.6.1
Fixed in
1.6.11.5.6· Vendor fix available
Issue
HashiCorp Vault and Vault Enterprise allowed the enumeration of users via the LDAP auth method. Fixed in 1.5.6 and 1.6.1.
Recommended action: Upgrade to 1.6.1 or 1.5.6 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
HashiCorp Vault and Vault Enterprise versions 0.8.3 and newer, when configured with the GCP GCE auth method, may be vulnerable to authentication bypass. Fixed in 1.2.5, 1.3.8, 1.4.4, and 1.5.1.
Recommended action: Upgrade to 1.5.1, 1.4.4, 1.3.8 or 1.2.5 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.