High severity · published Oct 10, 2024
CVE-2024-9180
Vault Operators in Root Namespace May Elevate Their Privileges
7.2
CVSS
0.5%
EPSS
No
On KEV
Description
A privileged Vault operator with write permissions to the root namespace’s identity endpoint could escalate their own or another user’s privileges to Vault’s root policy. Fixed in Vault Community Edition 1.18.0 and Vault Enterprise 1.18.0, 1.17.7, 1.16.11, and 1.15.16.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 44% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VA
Vault · HashiCorp
0.10.4 before 1.18.0 · source: vendor, NVD, CISA
VE
Vault Enterprise · HashiCorp
0.10.4 before 1.18.0 · source: vendor
OP
Openbao · Openbao
before 2.0.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-9180
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-9180
Vendor Advisory
https://discuss.hashicorp.com/t/hcsec-2024-21-vault-operators-in-root-namespace-may-elevate-their-privileges/70565
More from Vault
9.8
CVE-2024-2048
Vault Cert Auth Method Did Not Correctly Validate Non-CA Certificates
9.8
CVE-2020-35192
The official vault docker images before 0.11.6 contain a blank password for a root user
9.8
CVE-2020-12757
HashiCorp Vault and Vault Enterprise 1.4.0 and 1.4.1, when configured with the GCP Secrets Engine, may incorrectly generate GCP Credentials with the default time-to-live lease…
9.1
CVE-2025-6000
Arbitrary Remote Code Execution via Plugin Catalog Abuse
9.1
CVE-2022-40186
An issue was discovered in HashiCorp Vault and Vault Enterprise before 1.11.3