Vault Cert Auth Method Did Not Correctly Validate Non-CA Certificates

Arbitrary Remote Code Execution via Plugin Catalog Abuse

Vault Token Leaked to Backends via Authorization: Bearer Passthrough Header

Vault’s Azure Authentication Method bound_location Restriction Could be Bypassed on Login

Vault SSH Secrets Engine Configuration Did Not Restrict Valid Principals By Default

Vault Vulnerable to Server-Side Request Forgery in ACME Challenge Validation via Attacker-Controlled DNS

Vault Enterprise vulnerable to cross-namespace entity deletion

Vault KVv2 Metadata and Secret Deletion Policy Bypass Denial-of-Service

Vault AWS auth method bypass due to AWS client cache

Vault LDAP MFA Enforcement Bypass When Using Username As Alias

Vault Vulnerable to Arbitrary Code Execution via Plugin Catalog Entries Restored From Raft Snapshots

Vault Vulnerable to Denial-of-Service via Unauthenticated Root Token Generation/Rekey Operations

Vault Vulnerable to Denial of Service Due to Rate Limit Regression

Vault unauthenticated denial of service through complex json payload

Vault Vulnerable to Denial of Service When Processing Raft Join Requests

Vault Vulnerable to Denial of Service When Setting a Proxy Protocol Behavior

Vault Incorrectly Validated JSON Web Tokens (JWT) Audience Claims

Vault May be Vulnerable to a Denial of Service Through Memory Exhaustion When Handling Large HTTP Requests

Vault Requests Triggering Policy Checks May Lead To Unbounded Memory Consumption

Vault's Google Cloud Secrets Engine Removed Existing IAM Conditions When Creating / Updating Rolesets

Vault ACL Policy Evaluation May Allow Bypass of Deny Restrictions

Vault Root Namespace Operator May Elevate Token Privileges

Vault Operators in Root Namespace May Elevate Their Privileges

Vault Vulnerable to Privilege Escalation via Slash Injection in Templated Policy Paths

Vault Certificate Auth Method Did Not Validate Common Name For Non-CA Certificates

Vault TLS Cert Auth Method Did Not Correctly Validate OCSP Responses

Vault's Transit Secrets Engine Allowed Nonce Specified without Convergent Encryption

Vault TOTP Secrets Engine Code Reuse

Vault May Include Sensitive Data in Error Logs When Using the KV v2 Plugin

Vault Leaks AppRole Client Tokens And Accessor in Audit Log

Vault May Expose Sensitive Information When Configuring An Audit Log Device

Vault PKI ACME Issues Certificate With Unvalidated SANs

Vault Login MFA Bypass of Rate Limiting and TOTP Code Reuse

Vault Enterprise Leaks Sensitive HTTP Request Headers in the Audit Log When Deployed With a Performance Standby Node

Vault ACL Policy Cache Vulnerable to Cross-Namespace Policy Resolution

Vault’s KV Diff Viewer Allowed for HTML Injection

Vault Userpass and LDAP User Lockout Bypass

Vault's LDAP Auth Method Allows for User Enumeration

Vault Enterprise's Sentinel RGP Policies Allowed For Cross-Namespace Denial of Service

Vault Enterprise Namespace Creation May Lead to Denial of Service

Audit Log Plugin Directory Guard Bypass via Legacy path Option

Vault vulnerable to LIST authorization bypass via trailing-slash strip

Timing Side-Channel in Vault’s Userpass Auth Method

Vault Vulnerable to Recovery Key Cancellation Denial of Service