Hashicorp Vault
73 CVEs affecting Hashicorp Vault. Latest disclosed: 2026-07-01. Critical: 6, High: 24.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-35192 | Critical | 9.8 | 2020-12-17 | The official vault docker images before 0.11.6 contain a blank password for a root user. System using the vault docker container deployed by affected versions… |
CVE-2020-12757 | Critical | 9.8 | 2020-06-10 | HashiCorp Vault and Vault Enterprise 1.4.0 and 1.4.1, when configured with the GCP Secrets Engine, may incorrectly generate GCP Credentials with the default ti… |
CVE-2025-6000 | Critical | 9.1 | 2025-08-01 | A privileged Vault operator within the root namespace with write permission to {{sys/audit}} may obtain code execution on the underlying host if a plugin direc… |
CVE-2022-40186 | Critical | 9.1 | 2022-09-22 | An issue was discovered in HashiCorp Vault and Vault Enterprise before 1.11.3. A vulnerability in the Identity Engine was found where, in a deployment where an… |
CVE-2022-36129 | Critical | 9.1 | 2022-07-26 | HashiCorp Vault Enterprise 1.7.0 through 1.9.7, 1.10.4, and 1.11.0 clusters using Integrated Storage expose an unauthenticated API endpoint that could be abuse… |
CVE-2020-10661 | Critical | 9.1 | 2020-03-23 | HashiCorp Vault and Vault Enterprise versions 0.11.0 through 1.3.3 may, under certain circumstances, have existing nested-path policies grant access to Namespa… |
CVE-2020-16251 | High | 8.2 | 2020-08-26 | HashiCorp Vault and Vault Enterprise versions 0.8.3 and newer, when configured with the GCP GCE auth method, may be vulnerable to authentication bypass. Fixed… |
CVE-2020-16250 | High | 8.2 | 2020-08-26 | HashiCorp Vault and Vault Enterprise versions 0.7.1 and newer, when configured with the AWS IAM auth method, may be vulnerable to authentication bypass. Fixed… |
CVE-2026-3605 | High | 8.1 | 2026-04-17 | An authenticated user with access to a kvv2 path through a policy containing a glob may be able to delete secrets they were not authorized to read or write, re… |
CVE-2025-11621 | High | 8.1 | 2025-10-23 | Vault and Vault Enterprise’s (“Vault”) AWS Auth method may be susceptible to authentication bypass if the role of the configured bound_principal_iam is the sam… |
CVE-2024-2048 | High | 8.1 | 2024-03-04 | Vault and Vault Enterprise (“Vault”) TLS certificate auth method did not correctly validate client certificates when configured with a non-CA certificate as tr… |
CVE-2021-42135 | High | 8.1 | 2021-10-11 | HashiCorp Vault and Vault Enterprise 1.8.x through 1.8.4 may have an unexpected interaction between glob-related policies and the Google Cloud secrets engine… |
CVE-2018-19786 | High | 8.1 | 2018-12-05 | HashiCorp Vault before 1.0.0 writes the master key to the server log in certain unusual or misconfigured scenarios in which incorrect data comes from the autos… |
CVE-2023-5077 | High | 7.6 | 2023-09-29 | The Vault and Vault Enterprise ("Vault") Google Cloud secrets engine did not preserve existing Google Cloud IAM Conditions upon creating or updating rolesets… |
CVE-2026-5807 | High | 7.5 | 2026-04-17 | Vault is vulnerable to a denial-of-service condition where an unauthenticated attacker can repeatedly initiate or cancel root token generation or rekey operati… |
CVE-2026-4525 | High | 7.5 | 2026-04-17 | If a Vault auth mount is configured to pass through the "Authorization" header, and the "Authorization" header is used to authenticate to Vault, Vault forwarde… |
CVE-2025-12044 | High | 7.5 | 2025-10-23 | Vault and Vault Enterprise (“Vault”) are vulnerable to an unauthenticated denial of service when processing JSON payloads. This occurs due to a regression from… |
CVE-2025-6203 | High | 7.5 | 2025-08-28 | A malicious user may submit a specially-crafted complex payload that otherwise meets the default request size limit which results in excessive memory and CPU c… |
CVE-2024-8185 | High | 7.5 | 2024-10-31 | Vault Community and Vault Enterprise (“Vault”) clusters using Vault’s Integrated Storage backend are vulnerable to a denial-of-service (DoS) attack through mem… |
CVE-2024-7594 | High | 7.5 | 2024-09-26 | Vault’s SSH secrets engine did not require the valid_principals list to contain a value by default. If the valid_principals and default_user fields of the SSH… |