Hashicorp Vault - 50 CVEs (Page 1/1)

About “Hashicorp Vault”

A curated feed of “Hashicorp Vault”-related CVEs appears below. We currently track 50 CVEs for this tag (all time). In the last 365 days, 4 were published. Average CVSS is 6.3 (all time; 5.1 over 365d), and 40% are rated High/Critical (all time). Top CWEs (last 365 days): CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), CWE-295 - Improper Certificate Validation, CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal').

In our taxonomy this topic maps to a LOW impact class. Identity providers govern authentication across the estate. Upgrade, enforce phishing resistant MFA, review audit logs, rotate admin keys, and tighten policies. Use the filters below to sort by CVSS, risk and CWE. Each detail page highlights vendor advisories and mitigation tips.

Support & lifecycle: hashicorp-vault

This table shows recent release cycles and their projected end-of-life. Data source: endoflife.date.

Cycle	Release	Latest	EOL	LTS
2.0	2026-04-13	2.0.1	-
1.21	2025-10-21	1.21.4	2026-04-13 Expired
1.20	2025-06-23	1.20.4	2025-10-21 Expired
1.19	2025-03-04	1.19.5	2025-06-23 Expired	LTS
1.18	2024-10-08	1.18.5	2025-03-04 Expired
1.17	2024-06-10	1.17.6	2024-10-09 Expired
1.16	2024-03-25	1.16.3	2024-06-10 Expired	LTS
1.15	2023-09-22	1.15.6	2024-10-08 Expired
1.14	2023-06-19	1.14.10	2024-06-10 Expired
1.13	2023-03-01	1.13.13	2024-03-25 Expired
1.12	2022-10-10	1.12.11	2023-09-27 Expired
1.11	2022-06-17	1.11.12	2023-06-21 Expired
1.10	2022-03-21	1.10.11	2023-03-01 Expired
1.9	2021-11-16	1.9.10	2022-10-10 Expired

Maintained Soon (≤ 180 days) Expired

Subscribe lifecycle: RSS · RSS (expired) · ICS

Subscribe CVEs: RSS for “Hashicorp Vault” · RSS (High+Critical only)

CVEs tagged with this topic. Filters apply to the whole list (loaded from JSON).

CVSS ≥ 0.0

2026-04-21

Medium

CVE-2026-39946

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.3, when OpenBao revoked privileges on a role in the PostgreSQL database secrets engine, OpenBao failed to use…

CVSS: 4.9 CWE: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') View on NVD

Low

CVE-2026-39388

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.3, OpenBao's Certificate authentication method, when a token renewal is requested and `disable_binding=true` i…

CVSS: 3.1 CWE: CWE-295 - Improper Certificate Validation View on NVD

2025-12-22

High

CVE-2025-68476

KEDA is a Kubernetes-based Event Driven Autoscaling component. Prior to versions 2.17.3 and 2.18.3, an Arbitrary File Read vulnerability has been identified in KEDA, potentially affecting any KEDA re…

CVSS: 8.2 CWE: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') View on NVD

2025-12-10

Medium

CVE-2025-67642

Jenkins HashiCorp Vault Plugin 371.v884a_4dd60fb_6 and earlier does not set the appropriate context for Vault credentials lookup, allowing attackers with Item/Configure permission to access and poten…

CVSS: 4.3 CWE: CWE-282 - Improper Ownership Management View on NVD

2024-09-27

Low

CVE-2024-45744

TopQuadrant TopBraid EDG stores external credentials insecurely. An authenticated attacker with file system access can read edg-setup.properites and obtain the secret to decrypt external passwords st…

CVSS: 3.0 CWE: CWE-257 - Storing Passwords in a Recoverable Format View on NVD

2024-08-16

Low

CVE-2024-43808

In JetBrains TeamCity before 2024.07.1 self XSS was possible in the HashiCorp Vault plugin

CVSS: 3.7 CWE: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') View on NVD

2023-12-08

High

CVE-2023-6337

HashiCorp Vault and Vault Enterprise 1.12.0 and newer are vulnerable to a denial of service through memory exhaustion of the host when handling large unauthenticated and authenticated HTTP requests f…

CVSS: 7.5 CWE: CWE-770 - Allocation of Resources Without Limits or Throttling View on NVD

2023-11-09

Medium

CVE-2023-5954

HashiCorp Vault and Vault Enterprise inbound client requests triggering a policy check can lead to an unbounded consumption of memory. A large number of these requests may lead to denial-of-service.…

CVSS: 5.9 CWE: CWE-401 - Missing Release of Memory after Effective Lifetime View on NVD

2023-09-15

Medium

CVE-2023-4680

HashiCorp Vault and Vault Enterprise transit secrets engine allowed authorized users to specify arbitrary nonces, even with convergent encryption disabled. The encrypt endpoint, in combination with a…

CVSS: 6.8 CWE: CWE-323 - Reusing a Nonce, Key Pair in Encryption View on NVD

2023-05-16

High

CVE-2023-33001

Jenkins HashiCorp Vault Plugin 360.v0a_1c04cf807d and earlier does not properly mask (i.e., replace with asterisks) credentials in the build log when push mode for durable task logging is enabled.

CVSS: 7.5 CWE: CWE-532 - Insertion of Sensitive Information into Log File View on NVD

2023-05-01

Low

CVE-2023-2197

HashiCorp Vault Enterprise 1.13.0 up to 1.13.1 is vulnerable to a padding oracle attack when using an HSM in conjunction with the CKM_AES_CBC_PAD or CKM_AES_CBC encryption mechanisms. An attacker wit…

CVSS: 2.5 CWE: CWE-326 - Inadequate Encryption Strength View on NVD

2023-03-30

Medium

CVE-2023-25000

HashiCorp Vault's implementation of Shamir's secret sharing used precomputed table lookups, and was vulnerable to cache-timing attacks. An attacker with access to, and the ability to observe a large…

CVSS: 5.0 CWE: CWE-208 - Observable Timing Discrepancy View on NVD

Medium

CVE-2023-0665

HashiCorp Vault's PKI mount issuer endpoints did not correctly authorize access to remove an issuer or modify issuer metadata, potentially resulting in denial of service of the PKI mount. This bug di…

CVSS: 6.5 CWE: CWE-285 - Improper Authorization View on NVD

Medium

CVE-2023-0620

HashiCorp Vault and Vault Enterprise versions 0.8.0 through 1.13.1 are vulnerable to an SQL injection attack when configuring the Microsoft SQL (MSSQL) Database Storage Backend. When configuring the…

CVSS: 6.5 CWE: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') View on NVD

2023-03-11

Medium

CVE-2023-24999

HashiCorp Vault and Vault Enterprise’s approle auth method allowed any authenticated user with access to an approle destroy endpoint to destroy the secret ID of any other role by providing the secret…

CVSS: 4.4 CWE: CWE-863 - Incorrect Authorization View on NVD

2022-10-12

Medium

CVE-2022-41316

HashiCorp Vault and Vault Enterprise’s TLS certificate auth method did not initially load the optionally configured CRL issued by the role's CA into memory on startup, resulting in the revocation lis…

CVSS: 5.3 CWE: CWE-295 - Improper Certificate Validation View on NVD

2022-09-22

Critical

CVE-2022-40186

An issue was discovered in HashiCorp Vault and Vault Enterprise before 1.11.3. A vulnerability in the Identity Engine was found where, in a deployment where an entity has multiple mount accessors wit…

CVSS: 9.1 CWE: CWE-639 - Authorization Bypass Through User-Controlled Key View on NVD

2022-07-27

Medium

CVE-2022-36888

A missing permission check in Jenkins HashiCorp Vault Plugin 354.vdb_858fd6b_f48 and earlier allows attackers with Overall/Read permission to obtain credentials stored in Vault with attacker-specifie…

CVSS: 6.5 CWE: CWE-862 - Missing Authorization View on NVD

2022-07-26

Critical

CVE-2022-36129

HashiCorp Vault Enterprise 1.7.0 through 1.9.7, 1.10.4, and 1.11.0 clusters using Integrated Storage expose an unauthenticated API endpoint that could be abused to override the voter status of a node…

CVSS: 9.1 CWE: CWE-306 - Missing Authentication for Critical Function View on NVD

2022-05-17

Medium

CVE-2022-30689

HashiCorp Vault and Vault Enterprise from 1.10.0 to 1.10.2 did not correctly configure and enforce MFA on login after server restarts. This affects the Login MFA feature introduced in Vault and Vault…

CVSS: 5.3 CWE: N/A View on NVD

2022-02-15

Medium

CVE-2022-25197

Jenkins HashiCorp Vault Plugin 336.v182c0fbaaeb7 and earlier implements functionality that allows agent processes to read arbitrary files on the Jenkins controller file system.

CVSS: 6.5 CWE: N/A View on NVD

Medium

CVE-2022-25186

Jenkins HashiCorp Vault Plugin 3.8.0 and earlier implements functionality that allows agent processes to retrieve any Vault secrets for use on the agent, allowing attackers able to control agent proc…

CVSS: 6.5 CWE: N/A View on NVD

2022-01-12

Medium

CVE-2022-23109

Jenkins HashiCorp Vault Plugin 3.7.0 and earlier does not mask Vault credentials in Pipeline build logs or in Pipeline step descriptions when Pipeline: Groovy Plugin 2.85 or later is installed.

CVSS: 6.5 CWE: CWE-522 - Insufficiently Protected Credentials View on NVD

2021-12-17

Medium

CVE-2021-45042

In HashiCorp Vault and Vault Enterprise before 1.7.7, 1.8.x before 1.8.6, and 1.9.x before 1.9.1, clusters using the Integrated Storage backend allowed an authenticated user (with write permissions t…

CVSS: 4.9 CWE: N/A View on NVD

2021-12-16

High

CVE-2021-43837

vault-cli is a configurable command-line interface tool (and python library) to interact with Hashicorp Vault. In versions before 3.0.0 vault-cli features the ability for rendering templated values.…

CVSS: 8.4 CWE: CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') View on NVD

2021-11-30

Medium

CVE-2021-43998

HashiCorp Vault and Vault Enterprise 0.11.0 up to 1.7.5 and 1.8.4 templated ACL policies would always match the first-created entity alias if multiple entity aliases exist for a specified entity and…

CVSS: 6.5 CWE: CWE-732 - Incorrect Permission Assignment for Critical Resource View on NVD

2021-10-11

High

CVE-2021-42135

HashiCorp Vault and Vault Enterprise 1.8.x through 1.8.4 may have an unexpected interaction between glob-related policies and the Google Cloud secrets engine. Users may, in some situations, have more…

CVSS: 8.1 CWE: CWE-269 - Improper Privilege Management View on NVD

2021-10-08

Low

CVE-2021-41802

HashiCorp Vault and Vault Enterprise through 1.7.4 and 1.8.3 allowed a user with write permission to an entity alias ID sharing a mount accessor with another user to acquire this other user’s policie…

CVSS: 2.9 CWE: CWE-732 - Incorrect Permission Assignment for Critical Resource View on NVD

2021-08-31

Medium

CVE-2021-27668

HashiCorp Vault Enterprise 0.9.2 through 1.6.2 allowed the read of license metadata from DR secondaries without authentication. Fixed in 1.6.3.

CVSS: 5.3 CWE: CWE-306 - Missing Authentication for Critical Function View on NVD

2021-08-13

Medium

CVE-2021-38554

HashiCorp Vault and Vault Enterprise’s UI erroneously cached and exposed user-viewed secrets between sessions in a single shared browser. Fixed in 1.8.0 and pending 1.7.4 / 1.6.6 releases.

CVSS: 5.3 CWE: CWE-212 - Improper Removal of Sensitive Information Before Storage or Transfer View on NVD

Medium

CVE-2021-38553

HashiCorp Vault and Vault Enterprise 1.4.0 through 1.7.3 initialized an underlying database file associated with the Integrated Storage feature with excessively broad filesystem permissions. Fixed in…

CVSS: 4.4 CWE: CWE-281 - Improper Preservation of Permissions View on NVD

2021-06-03

High

CVE-2021-32923

HashiCorp Vault and Vault Enterprise allowed the renewal of nearly-expired token leases and dynamic secret leases (specifically, those within 1 second of their maximum TTL), which caused them to be i…

CVSS: 7.4 CWE: CWE-613 - Insufficient Session Expiration View on NVD

2021-05-07

High

CVE-2021-32074

HashiCorp vault-action (aka Vault GitHub Action) before 2.2.0 allows attackers to obtain sensitive information from log files because a multi-line secret was not correctly registered with GitHub Acti…

CVSS: 7.5 CWE: CWE-532 - Insertion of Sensitive Information into Log File View on NVD

2021-04-22

High

CVE-2021-29653

HashiCorp Vault and Vault Enterprise 1.5.1 and newer, under certain circumstances, may exclude revoked but unexpired certificates from the CRL. Fixed in 1.5.8, 1.6.4, and 1.7.1.

CVSS: 7.5 CWE: CWE-295 - Improper Certificate Validation View on NVD

High

CVE-2021-27400

HashiCorp Vault and Vault Enterprise Cassandra integrations (storage backend and database secrets engine plugin) did not validate TLS certificates when connecting to Cassandra clusters. Fixed in 1.6.…

CVSS: 7.5 CWE: CWE-295 - Improper Certificate Validation View on NVD

2021-02-01

High

CVE-2021-3282

HashiCorp Vault Enterprise 1.6.0 & 1.6.1 allowed the `remove-peer` raft operator command to be executed against DR secondaries without authentication. Fixed in 1.6.2.

CVSS: 7.5 CWE: CWE-287 - Improper Authentication View on NVD

Medium

CVE-2021-3024

HashiCorp Vault and Vault Enterprise disclosed the internal IP address of the Vault node when responding to some invalid, unauthenticated HTTP requests. Fixed in 1.6.2 & 1.5.7.

CVSS: 5.3 CWE: N/A View on NVD

Medium

CVE-2020-25594

HashiCorp Vault and Vault Enterprise allowed for enumeration of Secrets Engine mount paths via unauthenticated HTTP requests. Fixed in 1.6.2 & 1.5.7.

CVSS: 5.3 CWE: N/A View on NVD

2020-12-17

Medium

CVE-2020-35453

HashiCorp Vault Enterprise’s Sentinel EGP policy feature incorrectly allowed requests to be processed in parent and sibling namespaces. Fixed in 1.5.6 and 1.6.1.

CVSS: 5.3 CWE: N/A View on NVD

Medium

CVE-2020-35177

HashiCorp Vault and Vault Enterprise 1.4.1 and newer allowed the enumeration of users via the LDAP auth method. Fixed in 1.5.6 and 1.6.1.

CVSS: 5.3 CWE: CWE-209 - Generation of Error Message Containing Sensitive Information View on NVD

2020-09-30

Medium

CVE-2020-25816

HashiCorp Vault and Vault Enterprise versions 1.0 and newer allowed leases created with a batch token to outlive their TTL because expiration time was not scheduled correctly. Fixed in 1.4.7 and 1.5.…

CVSS: 6.8 CWE: N/A View on NVD

2020-08-26

High

CVE-2020-16251

HashiCorp Vault and Vault Enterprise versions 0.8.3 and newer, when configured with the GCP GCE auth method, may be vulnerable to authentication bypass. Fixed in 1.2.5, 1.3.8, 1.4.4, and 1.5.1.

CVSS: 8.2 CWE: CWE-287 - Improper Authentication View on NVD

High

CVE-2020-16250

HashiCorp Vault and Vault Enterprise versions 0.7.1 and newer, when configured with the AWS IAM auth method, may be vulnerable to authentication bypass. Fixed in 1.2.5, 1.3.8, 1.4.4, and 1.5.1..

CVSS: 8.2 CWE: CWE-290 - Authentication Bypass by Spoofing View on NVD

2020-08-20

High

CVE-2020-24359

HashiCorp vault-ssh-helper up to and including version 0.1.6 incorrectly accepted Vault-issued SSH OTPs for the subnet in which a host's network interface was located, rather than the specific IP add…

CVSS: 7.5 CWE: CWE-20 - Improper Input Validation View on NVD

2020-06-10

High

CVE-2020-13223

HashiCorp Vault and Vault Enterprise logged proxy environment variables that potentially included sensitive credentials. Fixed in 1.3.6 and 1.4.2.

CVSS: 7.5 CWE: CWE-532 - Insertion of Sensitive Information into Log File View on NVD

Critical

CVE-2020-12757

HashiCorp Vault and Vault Enterprise 1.4.0 and 1.4.1, when configured with the GCP Secrets Engine, may incorrectly generate GCP Credentials with the default time-to-live lease duration instead of the…

CVSS: 9.8 CWE: CWE-269 - Improper Privilege Management View on NVD

2020-03-23

Critical

CVE-2020-10661

HashiCorp Vault and Vault Enterprise versions 0.11.0 through 1.3.3 may, under certain circumstances, have existing nested-path policies grant access to Namespaces created after-the-fact. Fixed in 1.3…

CVSS: 9.1 CWE: N/A View on NVD

Medium

CVE-2020-10660

HashiCorp Vault and Vault Enterprise versions 0.9.0 through 1.3.3 may, under certain circumstances, have an Entity's Group membership inadvertently include Groups the Entity no longer has permissions…

CVSS: 5.3 CWE: CWE-276 - Incorrect Default Permissions View on NVD

2020-01-23

High

CVE-2020-7220

HashiCorp Vault Enterprise 0.11.0 through 1.3.1 fails, in certain circumstances, to revoke dynamic secrets for a mount in a deleted namespace. Fixed in 1.3.2.

CVSS: 7.5 CWE: CWE-404 - Improper Resource Shutdown or Release View on NVD

2018-12-05

High

CVE-2018-19786

HashiCorp Vault before 1.0.0 writes the master key to the server log in certain unusual or misconfigured scenarios in which incorrect data comes from the autoseal mechanism without an error being rep…

CVSS: 8.1 CWE: CWE-532 - Insertion of Sensitive Information into Log File View on NVD