Vault Cert Auth Method Did Not Correctly Validate Non-CA Certificates

The official vault docker images before 0.11.6 contain a blank password for a root user

HashiCorp Vault and Vault Enterprise 1.4.0 and 1.4.1, when configured with the GCP Secrets Engine, may incorrectly generate GCP Credentials with the default time-to-live lease…

Arbitrary Remote Code Execution via Plugin Catalog Abuse

An issue was discovered in HashiCorp Vault and Vault Enterprise before 1.11.3

HashiCorp Vault Enterprise 1.7.0 through 1.9.7, 1.10.4, and 1.11.0 clusters using Integrated Storage expose an unauthenticated API endpoint that could be abused to override the…

HashiCorp Vault and Vault Enterprise versions 0.11.0 through 1.3.3 may, under certain circumstances, have existing nested-path policies grant access to Namespaces created…

Vault Token Leaked to Backends via Authorization: Bearer Passthrough Header

Vault’s Azure Authentication Method bound_location Restriction Could be Bypassed on Login

Vault SSH Secrets Engine Configuration Did Not Restrict Valid Principals By Default

Vault Vulnerable to Server-Side Request Forgery in ACME Challenge Validation via Attacker-Controlled DNS

HashiCorp Vault and Vault Enterprise versions 0.8.3 and newer, when configured with the GCP GCE auth method, may be vulnerable to authentication bypass

HashiCorp Vault and Vault Enterprise versions 0.7.1 and newer, when configured with the AWS IAM auth method, may be vulnerable to authentication bypass

Vault KVv2 Metadata and Secret Deletion Policy Bypass Denial-of-Service

Vault AWS auth method bypass due to AWS client cache

Vault LDAP MFA Enforcement Bypass When Using Username As Alias

Vault Fails to Verify if the AppRole SecretID Belongs to Role During a Destroy Operation

HashiCorp Vault and Vault Enterprise 1.8.x through 1.8.4 may have an unexpected interaction between glob-related policies and the Google Cloud secrets engine

HashiCorp Vault before 1.0.0 writes the master key to the server log in certain unusual or misconfigured scenarios in which incorrect data comes from the autoseal mechanism…

Vault Vulnerable to Arbitrary Code Execution via Plugin Catalog Entries Restored From Raft Snapshots

Vault Vulnerable to Denial-of-Service via Unauthenticated Root Token Generation/Rekey Operations

Vault Vulnerable to Denial of Service Due to Rate Limit Regression

Vault unauthenticated denial of service through complex json payload

Vault Vulnerable to Denial of Service When Processing Raft Join Requests

Vault Vulnerable to Denial of Service When Setting a Proxy Protocol Behavior

Vault Incorrectly Validated JSON Web Tokens (JWT) Audience Claims

Vault May be Vulnerable to a Denial of Service Through Memory Exhaustion When Handling Large HTTP Requests

Vault Requests Triggering Policy Checks May Lead To Unbounded Memory Consumption

Vault's Google Cloud Secrets Engine Removed Existing IAM Conditions When Creating / Updating Rolesets

HashiCorp Vault and Vault Enterprise 1.5.1 and newer, under certain circumstances, may exclude revoked but unexpired certificates from the CRL

HashiCorp Vault and Vault Enterprise Cassandra integrations (storage backend and database secrets engine plugin) did not validate TLS certificates when connecting to Cassandra…

HashiCorp Vault Enterprise 1.6.0 & 1.6.1 allowed the `remove-peer` raft operator command to be executed against DR secondaries without authentication

HashiCorp Vault and Vault Enterprise logged proxy environment variables that potentially included sensitive credentials

HashiCorp Vault Enterprise 0.11.0 through 1.3.1 fails, in certain circumstances, to revoke dynamic secrets for a mount in a deleted namespace

HashiCorp Vault and Vault Enterprise allowed the renewal of nearly-expired token leases and dynamic secret leases (specifically, those within 1 second of their maximum TTL), which…

Vault ACL Policy Evaluation May Allow Bypass of Deny Restrictions

Vault Root Namespace Operator May Elevate Token Privileges

Vault Operators in Root Namespace May Elevate Their Privileges

Vault Vulnerable to Privilege Escalation via Slash Injection in Templated Policy Paths

Vault Certificate Auth Method Did Not Validate Common Name For Non-CA Certificates

Vault TLS Cert Auth Method Did Not Correctly Validate OCSP Responses

Vault's Transit Secrets Engine Allowed Nonce Specified without Convergent Encryption

HashiCorp Vault and Vault Enterprise versions 1.0 and newer allowed leases created with a batch token to outlive their TTL because expiration time was not scheduled correctly

Vault Vulnerable to SQL Injection When Configuring the Microsoft SQL Database Storage Backend

Vault TOTP Secrets Engine Code Reuse

Vault May Include Sensitive Data in Error Logs When Using the KV v2 Plugin

Vault Leaks AppRole Client Tokens And Accessor in Audit Log

Vault May Expose Sensitive Information When Configuring An Audit Log Device

Vault PKI Issuer Endpoint Did Not Correctly Authorize Access to Issuer Metadata

Vault Enterprise clusters using the tokenization transform feature can expose the tokenization key through the tokenization key configuration endpoint to authorized operators with…