github.com/hashicorp/vault (Go)
Advisories
149
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 1.21.0 or later clears every advisory below that has a fix.
Upgrade commands
go
go get github.com/hashicorp/vault@v1.21.0 && go mod tidyKnown vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-88v5-9hxc-f85r HashiCorp Vault Vulnerable to Denial-of-Service via Unauthenticated Root Token Generation/Rekey Operations |
High EPSS 0.72% |
<= 1.21.4 | No fix yet |
| GHSA-88v5-9hxc-f85r HashiCorp Vault Vulnerable to Denial-of-Service via Unauthenticated Root Token Generation/Rekey Operations |
High EPSS 0.72% |
all versions | No fix yet |
| GHSA-8r5m-3f66-qpr3 HashiCorp Vault has Server-Side Request Forgery in ACME Challenge Validation via Attacker-Controlled DNS |
High EPSS 0.34% |
>= 1.14.0 | No fix yet |
| GHSA-8r5m-3f66-qpr3 HashiCorp Vault has Server-Side Request Forgery in ACME Challenge Validation via Attacker-Controlled DNS |
High EPSS 0.34% |
>= 1.14.0, <= 1.21.4 | No fix yet |
| GHSA-72gw-fmmr-c4r4 HashiCorp Vault May Expose Tokens to Auth Plugins Due to Incorrect Header Sanitization |
High EPSS 0.41% |
>= 0.11.2, <= 1.21.4 | No fix yet |
| GHSA-72gw-fmmr-c4r4 HashiCorp Vault May Expose Tokens to Auth Plugins Due to Incorrect Header Sanitization |
High EPSS 0.41% |
>= 0.11.2 | No fix yet |
| GHSA-m2w4-8ggf-rj47 HashiCorp Vault has a KVv2 Metadata and Secret Deletion Policy Bypass that leads to Denial-of-Service |
High EPSS 0.38% |
>= 0.10.0, <= 1.21.4 | No fix yet |
| GHSA-m2w4-8ggf-rj47 HashiCorp Vault has a KVv2 Metadata and Secret Deletion Policy Bypass that leads to Denial-of-Service |
High EPSS 0.38% |
>= 0.10.0 | No fix yet |
| GHSA-vp5w-xcfc-73wf Hashicorp Vault and Vault Enterprise vulnerable to a denial of service when processing JSON |
High EPSS 0.53% |
>= 1.20.3, < 1.21.0 | 1.21.0 |
| GHSA-vp5w-xcfc-73wf Hashicorp Vault and Vault Enterprise vulnerable to a denial of service when processing JSON |
High EPSS 0.53% |
>= 1.20.3, < 1.21.0 | 1.21.0 |
| GHSA-9g4h-h484-3578 HashiCorp Vault and Vault Enterprise's AWS Auth method may be susceptible to authentication bypass |
High EPSS 0.49% |
>= 0.6.0, < 1.21.0 | 1.21.0 |
| GHSA-9g4h-h484-3578 HashiCorp Vault and Vault Enterprise's AWS Auth method may be susceptible to authentication bypass |
High EPSS 0.49% |
>= 0.6.0, < 1.21.0 | 1.21.0 |
| GHSA-8f82-53h8-2p34 HashiCorp Vault Community Edition Denial of Service Though Complex JSON Payloads |
High EPSS 0.73% |
< 1.20.3 | 1.20.3 |
| GHSA-8f82-53h8-2p34 HashiCorp Vault Community Edition Denial of Service Though Complex JSON Payloads |
High EPSS 0.73% |
< 1.20.3 | 1.20.3 |
| GHSA-7rx2-769v-hrwf HashiCorp Vault ldap auth method may not have correctly enforced MFA |
High EPSS 0.53% |
< 1.20.2 | 1.20.2 |
| GHSA-7rx2-769v-hrwf HashiCorp Vault ldap auth method may not have correctly enforced MFA |
High EPSS 0.53% |
< 1.20.2 | 1.20.2 |
| GHSA-6c5r-4wfc-3mcx Hashicorp Vault has Incorrect Validation for Non-CA Certificates |
Medium EPSS 0.26% |
< 1.20.1 | 1.20.1 |
| GHSA-6c5r-4wfc-3mcx Hashicorp Vault has Incorrect Validation for Non-CA Certificates |
Medium EPSS 0.26% |
< 1.20.1 | 1.20.1 |
| GHSA-v6r4-35f9-9rpw Hashicorp Vault has Login MFA Rate Limit Bypass Vulnerability |
Medium EPSS 0.35% |
>= 1.10.0, < 1.20.1 | 1.20.1 |
| GHSA-v6r4-35f9-9rpw Hashicorp Vault has Login MFA Rate Limit Bypass Vulnerability |
Medium EPSS 0.35% |
>= 1.10.0, < 1.20.1 | 1.20.1 |
| GHSA-qv3p-fmv3-9hww Hashicorp Vault's TOTP Secrets Engine Susceptible to Code Reuse |
Medium EPSS 0.42% |
< 1.20.1 | 1.20.1 |
| GHSA-qv3p-fmv3-9hww Hashicorp Vault's TOTP Secrets Engine Susceptible to Code Reuse |
Medium EPSS 0.42% |
< 1.20.1 | 1.20.1 |
| GHSA-mwgr-84fv-3jh9 Hashicorp Vault has an Observable Discrepancy on Existing and Non-Existing Users |
Low EPSS 0.36% |
< 1.20.1 | 1.20.1 |
| GHSA-mwgr-84fv-3jh9 Hashicorp Vault has an Observable Discrepancy on Existing and Non-Existing Users |
Low EPSS 0.36% |
< 1.20.1 | 1.20.1 |
| GHSA-qgj7-fmq2-6cc4 Hashicorp Vault has Lockout Feature Authentication Bypass |
Medium EPSS 0.45% |
>= 1.13.0, < 1.20.1 | 1.20.1 |
| GHSA-qgj7-fmq2-6cc4 Hashicorp Vault has Lockout Feature Authentication Bypass |
Medium EPSS 0.45% |
>= 1.13.0, < 1.20.1 | 1.20.1 |
| GHSA-mr4h-qf9j-f665 Hashicorp Vault has Code Execution Vulnerability via Plugin Configuration |
Critical EPSS 0.95% |
>= 0.8.0, < 1.20.1 | 1.20.1 |
| GHSA-mr4h-qf9j-f665 Hashicorp Vault has Code Execution Vulnerability via Plugin Configuration |
Critical EPSS 0.95% |
>= 0.8.0, < 1.20.1 | 1.20.1 |
| GHSA-6h4p-m86h-hhgh Hashicorp Vault has Privilege Escalation Vulnerability |
High EPSS 0.51% |
>= 0.10.4, < 1.20.0 | 1.20.0 |
| GHSA-6h4p-m86h-hhgh Hashicorp Vault has Privilege Escalation Vulnerability |
High EPSS 0.51% |
>= 0.10.4, < 1.20.0 | 1.20.0 |
| GHSA-fhc2-8qx8-6vj7 Vault Community Edition rekey and recovery key operations can cause denial of service |
Low EPSS 0.27% |
>= 1.14.8, < 1.20.0 | 1.20.0 |
| GHSA-fhc2-8qx8-6vj7 Vault Community Edition rekey and recovery key operations can cause denial of service |
Low EPSS 0.27% |
>= 1.14.8, < 1.20.0 | 1.20.0 |
| GHSA-f9ch-h8j7-8jwg Hashicorp Vault Community vulnerable to Incorrect Authorization |
High EPSS 0.44% |
>= 1.10.0, < 1.19.1 | 1.19.1 |
| GHSA-f9ch-h8j7-8jwg Hashicorp Vault Community vulnerable to Incorrect Authorization |
High EPSS 0.44% |
>= 1.10.0, < 1.19.1 | 1.19.1 |
| GHSA-gcqf-f89c-68hv Hashicorp Vault Community vulnerable to Generation of Error Message Containing Sensitive Information |
Medium EPSS 0.45% |
>= 0.3.0, < 1.19.3 | 1.19.3 |
| GHSA-gcqf-f89c-68hv Hashicorp Vault Community vulnerable to Generation of Error Message Containing Sensitive Information |
Medium EPSS 0.45% |
>= 0.3.0, < 1.19.3 | 1.19.3 |
| GHSA-g233-2p4r-3q7v Hashicorp Vault vulnerable to denial of service through memory exhaustion |
High EPSS 0.48% |
>= 1.2.0, < 1.18.1 | 1.18.1 |
| GHSA-g233-2p4r-3q7v Hashicorp Vault vulnerable to denial of service through memory exhaustion |
High EPSS 0.48% |
>= 1.2.0, < 1.18.1 | 1.18.1 |
| GHSA-rr8j-7w34-xp5j Vault Community Edition privilege escalation vulnerability |
High EPSS 0.53% |
< 1.18.0 | 1.18.0 |
| GHSA-rr8j-7w34-xp5j Vault Community Edition privilege escalation vulnerability |
High EPSS 0.53% |
< 1.18.0 | 1.18.0 |
| GHSA-jg74-mwgw-v6x3 Vault SSH Secrets Engine Configuration Did Not Restrict Valid Principals By Default |
High EPSS 0.27% |
>= 1.7.7, < 1.17.6 | 1.17.6 |
| GHSA-jg74-mwgw-v6x3 Vault SSH Secrets Engine Configuration Did Not Restrict Valid Principals By Default |
High EPSS 0.27% |
>= 1.7.7, < 1.17.6 | 1.17.6 |
| GHSA-jjxf-26c9-77gm Vault Leaks Client Token and Token Accessor in Audit Devices |
Medium EPSS 0.46% |
>= 1.17.3, < 1.17.5 | 1.17.5 |
| GHSA-jjxf-26c9-77gm Vault Leaks Client Token and Token Accessor in Audit Devices |
Medium EPSS 0.46% |
>= 1.17.3, < 1.17.5 | 1.17.5 |
| GHSA-2qmw-pvf7-4mw6 Hashicorp Vault vulnerable to Improper Check or Handling of Exceptional Conditions |
High EPSS 0.49% |
>= 1.10.0, < 1.16.3>= 1.17.0-rc1, < 1.17.2 | 1.16.31.17.2 |
| GHSA-2qmw-pvf7-4mw6 Hashicorp Vault vulnerable to Improper Check or Handling of Exceptional Conditions |
High EPSS 0.49% |
>= 1.10.0, < 1.15.12 | 1.15.12 |
| GHSA-2qmw-pvf7-4mw6 Hashicorp Vault vulnerable to Improper Check or Handling of Exceptional Conditions |
High EPSS 0.49% |
>= 1.16.0-rc1, < 1.16.3 | 1.16.3 |
| GHSA-2qmw-pvf7-4mw6 Hashicorp Vault vulnerable to Improper Check or Handling of Exceptional Conditions |
High EPSS 0.49% |
>= 1.17.0-rc1, < 1.17.2 | 1.17.2 |
| GHSA-32cj-5wx4-gq8p HashiCorp Vault Incorrectly Validated JSON Web Tokens (JWT) Audience Claims |
High EPSS 0.34% |
>= 0.11.0, < 1.16.3>= 1.17.0-rc1, < 1.17.0 | 1.16.31.17.0 |
| GHSA-32cj-5wx4-gq8p HashiCorp Vault Incorrectly Validated JSON Web Tokens (JWT) Audience Claims |
High EPSS 0.34% |
>= 0.11.0, < 1.15.9 | 1.15.9 |
| GHSA-32cj-5wx4-gq8p HashiCorp Vault Incorrectly Validated JSON Web Tokens (JWT) Audience Claims |
High EPSS 0.34% |
>= 1.16.0-rc1, < 1.16.3 | 1.16.3 |
| GHSA-32cj-5wx4-gq8p HashiCorp Vault Incorrectly Validated JSON Web Tokens (JWT) Audience Claims |
High EPSS 0.34% |
>= 1.17.0-rc1, < 1.17.0 | 1.17.0 |
| GHSA-j2rp-gmqv-frhv HashiCorpVault does not correctly validate OCSP responses |
Medium EPSS 0.30% |
< 1.16.0 | 1.16.0 |
| GHSA-j2rp-gmqv-frhv HashiCorpVault does not correctly validate OCSP responses |
Medium EPSS 0.30% |
< 1.16.0 | 1.16.0 |
| GHSA-r3w7-mfpm-c2vw Incorrect TLS certificate auth method in Vault |
Critical EPSS 0.45% |
>= 1.15.0, < 1.15.5 | 1.15.5 |
| GHSA-r3w7-mfpm-c2vw Incorrect TLS certificate auth method in Vault |
Critical EPSS 0.45% |
< 1.14.10 | 1.14.10 |
| GHSA-r3w7-mfpm-c2vw Incorrect TLS certificate auth method in Vault |
Critical EPSS 0.45% |
< 1.14.10>= 1.15.0, < 1.15.5 | 1.14.101.15.5 |
| GHSA-vgh3-mwxq-rcp8 Hashicorp Vault may expose sensitive log information |
Medium EPSS 0.76% |
>= 1.15.0, < 1.15.5 | 1.15.5 |
| GHSA-vgh3-mwxq-rcp8 Hashicorp Vault may expose sensitive log information |
Medium EPSS 0.76% |
>= 1.15.0, < 1.15.5 | 1.15.5 |
| GHSA-rq95-xf66-j689 Improper Authentication in HashiCorp Vault |
High EPSS 1.31% |
>= 1.6.0, < 1.6.2 | 1.6.2 |
| GHSA-rq95-xf66-j689 Improper Authentication in HashiCorp Vault |
High EPSS 1.31% |
>= 1.6.0, < 1.6.2 | 1.6.2 |
| GHSA-rpgp-9hmg-j25x Enumeration of users in HashiCorp Vault |
Medium EPSS 1.22% |
>= 1.5.0, < 1.5.6>= 1.6.0, < 1.6.1 | 1.5.61.6.1 |
| GHSA-rpgp-9hmg-j25x Enumeration of users in HashiCorp Vault |
Medium EPSS 1.22% |
>= 1.6.0, < 1.6.1 | 1.6.1 |
| GHSA-rpgp-9hmg-j25x Enumeration of users in HashiCorp Vault |
Medium EPSS 1.22% |
>= 1.5.0, < 1.5.6 | 1.5.6 |
| GHSA-4mp7-2m29-gqxf HashiCorp Vault Authentication bypass |
High EPSS 2.83% |
>= 1.5.0, < 1.5.1 | 1.5.1 |
| GHSA-4mp7-2m29-gqxf HashiCorp Vault Authentication bypass |
High EPSS 2.83% |
>= 0.8.3, < 1.2.5 | 1.2.5 |
| GHSA-4mp7-2m29-gqxf HashiCorp Vault Authentication bypass |
High EPSS 2.83% |
>= 1.3.0, < 1.3.8 | 1.3.8 |
| GHSA-4mp7-2m29-gqxf HashiCorp Vault Authentication bypass |
High EPSS 2.83% |
>= 1.4.0, < 1.4.4 | 1.4.4 |
| GHSA-4mp7-2m29-gqxf HashiCorp Vault Authentication bypass |
High EPSS 2.83% |
>= 0.8.3, < 1.2.5>= 1.3.0, < 1.3.8>= 1.4.0, < 1.4.4>= 1.5.0, < 1.5.1 | 1.2.51.3.81.4.41.5.1 |
| GHSA-m979-w9wj-qfj9 HashiCorp Vault Improper Privilege Management |
Medium EPSS 0.76% |
>= 0.9.0, < 1.3.4 | 1.3.4 |
| GHSA-m979-w9wj-qfj9 HashiCorp Vault Improper Privilege Management |
Medium EPSS 0.76% |
>= 0.9.0, < 1.3.4 | 1.3.4 |
| GHSA-j6vv-vv26-rh7c HashiCorp Vault Improper Privilege Management |
Critical EPSS 1.12% |
>= 0.11.0, < 1.3.4 | 1.3.4 |
| GHSA-j6vv-vv26-rh7c HashiCorp Vault Improper Privilege Management |
Critical EPSS 1.12% |
>= 0.11.0, < 1.3.4 | 1.3.4 |
| GHSA-6p62-6cg9-f5f5 Memory exhaustion in HashiCorp Vault |
High EPSS 0.79% |
>= 1.12.0, < 1.13.12 | 1.13.12 |
| GHSA-6p62-6cg9-f5f5 Memory exhaustion in HashiCorp Vault |
High EPSS 0.79% |
>= 1.15.0, < 1.15.4 | 1.15.4 |
| GHSA-6p62-6cg9-f5f5 Memory exhaustion in HashiCorp Vault |
High EPSS 0.79% |
>= 1.14.0, < 1.14.8 | 1.14.8 |
| GHSA-6p62-6cg9-f5f5 Memory exhaustion in HashiCorp Vault |
High EPSS 0.79% |
>= 1.12.0, < 1.13.12>= 1.14.0, < 1.14.8>= 1.15.0, < 1.15.4 | 1.13.121.14.81.15.4 |
| GHSA-4qhc-v8r6-8vwm HashiCorp Vault Missing Release of Memory after Effective Lifetime vulnerability |
High EPSS 0.72% |
< 1.13.10>= 1.14.0, < 1.14.6>= 1.15.0, < 1.15.2 | 1.13.101.14.61.15.2 |
| GHSA-4qhc-v8r6-8vwm HashiCorp Vault Missing Release of Memory after Effective Lifetime vulnerability |
High EPSS 0.72% |
>= 1.15.0, < 1.15.2 | 1.15.2 |
| GHSA-4qhc-v8r6-8vwm HashiCorp Vault Missing Release of Memory after Effective Lifetime vulnerability |
High EPSS 0.72% |
>= 1.14.0, < 1.14.6 | 1.14.6 |
| GHSA-4qhc-v8r6-8vwm HashiCorp Vault Missing Release of Memory after Effective Lifetime vulnerability |
High EPSS 0.72% |
< 1.13.10 | 1.13.10 |
| GHSA-86c6-3g63-5w64 Hashicorp Vault Incorrect Permission Assignment for Critical Resource vulnerability |
High EPSS 0.51% |
< 1.13.0 | 1.13.0 |
| GHSA-86c6-3g63-5w64 Hashicorp Vault Incorrect Permission Assignment for Critical Resource vulnerability |
High EPSS 0.51% |
< 1.13.0 | 1.13.0 |
| GHSA-v84f-6r39-cpfc HashiCorp Vault Improper Input Validation vulnerability |
Medium EPSS 0.44% |
>= 1.6.0, < 1.12.11 | 1.12.11 |
| GHSA-v84f-6r39-cpfc HashiCorp Vault Improper Input Validation vulnerability |
Medium EPSS 0.44% |
>= 1.6.0, < 1.12.11>= 1.13.0, < 1.13.7>= 1.14.0, < 1.14.3 | 1.12.111.13.71.14.3 |
| GHSA-v84f-6r39-cpfc HashiCorp Vault Improper Input Validation vulnerability |
Medium EPSS 0.44% |
>= 1.14.0, < 1.14.3 | 1.14.3 |
| GHSA-v84f-6r39-cpfc HashiCorp Vault Improper Input Validation vulnerability |
Medium EPSS 0.44% |
>= 1.13.0, < 1.13.7 | 1.13.7 |
| GHSA-9v3w-w2jh-4hff HashiCorp Vault and Vault Enterprise vulnerable to user enumeration |
Medium EPSS 0.61% |
< 1.13.5 | 1.13.5 |
| GHSA-9v3w-w2jh-4hff HashiCorp Vault and Vault Enterprise vulnerable to user enumeration |
Medium EPSS 0.61% |
>= 1.14.0, < 1.14.1 | 1.14.1 |
| GHSA-9v3w-w2jh-4hff HashiCorp Vault and Vault Enterprise vulnerable to user enumeration |
Medium EPSS 0.61% |
< 1.13.5>= 1.14.0, < 1.14.1 | 1.13.51.14.1 |
| GHSA-gq98-53rq-qr5h Hashicorp Vault vulnerable to Cross-site Scripting |
Medium EPSS 0.42% |
>= 1.13.0, < 1.13.3 | 1.13.3 |
| GHSA-gq98-53rq-qr5h Hashicorp Vault vulnerable to Cross-site Scripting |
Medium EPSS 0.42% |
< 1.11.11 | 1.11.11 |
| GHSA-gq98-53rq-qr5h Hashicorp Vault vulnerable to Cross-site Scripting |
Medium EPSS 0.42% |
< 1.11.11>= 1.12.0, < 1.12.7>= 1.13.0, < 1.13.3 | 1.11.111.12.71.13.3 |
| GHSA-gq98-53rq-qr5h Hashicorp Vault vulnerable to Cross-site Scripting |
Medium EPSS 0.42% |
>= 1.12.0, < 1.12.7 | 1.12.7 |
| GHSA-vq4h-9ghm-qmrr HashiCorp Vault's implementation of Shamir's secret sharing vulnerable to cache-timing attacks |
Medium EPSS 0.21% |
>= 1.13.0, < 1.13.1 | 1.13.1 |
| GHSA-vq4h-9ghm-qmrr HashiCorp Vault's implementation of Shamir's secret sharing vulnerable to cache-timing attacks |
Medium EPSS 0.21% |
>= 1.12.0, < 1.12.5 | 1.12.5 |
| GHSA-vq4h-9ghm-qmrr HashiCorp Vault's implementation of Shamir's secret sharing vulnerable to cache-timing attacks |
Medium EPSS 0.21% |
< 1.11.9 | 1.11.9 |
| GHSA-vq4h-9ghm-qmrr HashiCorp Vault's implementation of Shamir's secret sharing vulnerable to cache-timing attacks |
Medium EPSS 0.21% |
< 1.11.9>= 1.12.0, < 1.12.5>= 1.13.0, < 1.13.1 | 1.11.91.12.51.13.1 |
| GHSA-hwc3-3qh6-r4gg HashiCorp Vault's PKI mount vulnerable to denial of service |
Medium EPSS 0.33% |
>= 1.13.0, < 1.13.1 | 1.13.1 |
| GHSA-hwc3-3qh6-r4gg HashiCorp Vault's PKI mount vulnerable to denial of service |
Medium EPSS 0.33% |
< 1.11.9 | 1.11.9 |
| GHSA-hwc3-3qh6-r4gg HashiCorp Vault's PKI mount vulnerable to denial of service |
Medium EPSS 0.33% |
>= 1.12.0, < 1.12.5 | 1.12.5 |
| GHSA-hwc3-3qh6-r4gg HashiCorp Vault's PKI mount vulnerable to denial of service |
Medium EPSS 0.33% |
< 1.11.9>= 1.12.0, < 1.12.5>= 1.13.0, < 1.13.1 | 1.11.91.12.51.13.1 |
| GHSA-v3hp-mcj5-pg39 HashiCorp Vault’s Microsoft SQL Database Storage Backend Vulnerable to SQL Injection Via Configuration File |
Medium EPSS 0.38% |
>= 1.12.0, < 1.12.5 | 1.12.5 |
| GHSA-v3hp-mcj5-pg39 HashiCorp Vault’s Microsoft SQL Database Storage Backend Vulnerable to SQL Injection Via Configuration File |
Medium EPSS 0.38% |
>= 1.13.0, < 1.13.1 | 1.13.1 |
| GHSA-v3hp-mcj5-pg39 HashiCorp Vault’s Microsoft SQL Database Storage Backend Vulnerable to SQL Injection Via Configuration File |
Medium EPSS 0.38% |
>= 0.8.0, < 1.11.9>= 1.12.0, < 1.12.5>= 1.13.0, < 1.13.1 | 1.11.91.12.51.13.1 |
| GHSA-v3hp-mcj5-pg39 HashiCorp Vault’s Microsoft SQL Database Storage Backend Vulnerable to SQL Injection Via Configuration File |
Medium EPSS 0.38% |
>= 0.8.0, < 1.11.9 | 1.11.9 |
| GHSA-wmg5-g953-qqfw Hashicorp Vault Fails to Verify if Approle SecretID Belongs to Role During a Destroy Operation |
High EPSS 0.60% |
< 1.10.11>= 1.11.0, < 1.11.8>= 1.12.0, < 1.12.4 | 1.10.111.11.81.12.4 |
| GHSA-wmg5-g953-qqfw Hashicorp Vault Fails to Verify if Approle SecretID Belongs to Role During a Destroy Operation |
High EPSS 0.60% |
< 1.10.11 | 1.10.11 |
| GHSA-wmg5-g953-qqfw Hashicorp Vault Fails to Verify if Approle SecretID Belongs to Role During a Destroy Operation |
High EPSS 0.60% |
>= 1.11.0, < 1.11.8 | 1.11.8 |
| GHSA-wmg5-g953-qqfw Hashicorp Vault Fails to Verify if Approle SecretID Belongs to Role During a Destroy Operation |
High EPSS 0.60% |
>= 1.12.0, < 1.12.4 | 1.12.4 |
| GHSA-9mh8-9j64-443f HashiCorp Vault's revocation list not respected |
Medium EPSS 0.52% |
>= 1.11.0, < 1.11.4 | 1.11.4 |
| GHSA-9mh8-9j64-443f HashiCorp Vault's revocation list not respected |
Medium EPSS 0.52% |
< 1.9.10>= 1.10.0, < 1.10.7>= 1.11.0, < 1.11.4 | 1.9.101.10.71.11.4 |
| GHSA-9mh8-9j64-443f HashiCorp Vault's revocation list not respected |
Medium EPSS 0.52% |
< 1.9.10 | 1.9.10 |
| GHSA-9mh8-9j64-443f HashiCorp Vault's revocation list not respected |
Medium EPSS 0.52% |
>= 1.10.0, < 1.10.7 | 1.10.7 |
| GHSA-7cgv-v83v-rr87 HashiCorp Vault vulnerable to incorrect metadata access |
Critical EPSS 1.00% |
>= 1.11.0, < 1.11.3 | 1.11.3 |
| GHSA-7cgv-v83v-rr87 HashiCorp Vault vulnerable to incorrect metadata access |
Critical EPSS 1.00% |
>= 1.10.0, < 1.10.6 | 1.10.6 |
| GHSA-7cgv-v83v-rr87 HashiCorp Vault vulnerable to incorrect metadata access |
Critical EPSS 1.00% |
>= 1.8.0, < 1.9.9>= 1.10.0, < 1.10.6>= 1.11.0, < 1.11.3 | 1.9.91.10.61.11.3 |
| GHSA-7cgv-v83v-rr87 HashiCorp Vault vulnerable to incorrect metadata access |
Critical EPSS 1.00% |
>= 1.8.0, < 1.9.9 | 1.9.9 |
| GHSA-57gg-cj55-q5g2 Token leases could outlive their TTL in HashiCorp Vault |
Critical EPSS 1.01% |
>= 1.0.0-beta1, < 1.5.4 | 1.5.4 |
| GHSA-57gg-cj55-q5g2 Token leases could outlive their TTL in HashiCorp Vault |
Critical EPSS 1.01% |
>= 1.0.0, < 1.5.4 | 1.5.4 |
| GHSA-c5wc-v287-82pc HashiCorp Vault improper configuration of multi factor authentication |
Medium EPSS 1.21% |
>= 1.10.0, < 1.10.3 | 1.10.3 |
| GHSA-c5wc-v287-82pc HashiCorp Vault improper configuration of multi factor authentication |
Medium EPSS 1.21% |
>= 1.10.0, < 1.10.3 | 1.10.3 |
| GHSA-pfmw-vj74-ph8g HashiCorp Vault Incorrect Permission Assignment for Critical Resource |
Critical EPSS 1.04% |
>= 1.8.0, < 1.8.5 | 1.8.5 |
| GHSA-pfmw-vj74-ph8g HashiCorp Vault Incorrect Permission Assignment for Critical Resource |
Critical EPSS 1.04% |
>= 0.11.0, < 1.7.6>= 1.8.0, < 1.8.5 | 1.7.61.8.5 |
| GHSA-pfmw-vj74-ph8g HashiCorp Vault Incorrect Permission Assignment for Critical Resource |
Critical EPSS 1.04% |
>= 0.11.0, < 1.7.6 | 1.7.6 |
| GHSA-362v-wg5p-64w2 Incorrect Privilege Assignment in HashiCorp Vault |
High EPSS 0.78% |
>= 1.8.0, < 1.8.5 | 1.8.5 |
| GHSA-362v-wg5p-64w2 Incorrect Privilege Assignment in HashiCorp Vault |
High EPSS 0.78% |
>= 1.8.0, <= 1.8.4 | No fix yet |
| GHSA-qv95-g3gm-x542 Hashicorp Vault Privilege Escalation Vulnerability |
Low EPSS 0.61% |
>= 1.8.0, < 1.8.4 | 1.8.4 |
| GHSA-qv95-g3gm-x542 Hashicorp Vault Privilege Escalation Vulnerability |
Low EPSS 0.61% |
< 1.7.5>= 1.8.0, < 1.8.4 | 1.7.51.8.4 |
| GHSA-qv95-g3gm-x542 Hashicorp Vault Privilege Escalation Vulnerability |
Low EPSS 0.61% |
< 1.7.5 | 1.7.5 |
| GHSA-23fq-q7hc-993r HashiCorp Vault underlying database had excessively broad filesystem permissions from v1.4.0 until v1.8.0 |
Critical EPSS 0.27% |
>= 1.4.0, < 1.8.0 | 1.8.0 |
| GHSA-23fq-q7hc-993r HashiCorp Vault underlying database had excessively broad filesystem permissions from v1.4.0 until v1.8.0 |
Critical EPSS 0.27% |
>= 1.4.0, < 1.8.0 | 1.8.0 |
| GHSA-6239-28c2-9mrm Improper Removal of Sensitive Information Before Storage or Transfer in HashiCorp Vault |
Medium EPSS 0.91% |
>= 1.7.0, < 1.7.4 | 1.7.4 |
| GHSA-6239-28c2-9mrm Improper Removal of Sensitive Information Before Storage or Transfer in HashiCorp Vault |
Medium EPSS 0.91% |
< 1.6.6 | 1.6.6 |
| GHSA-6239-28c2-9mrm Improper Removal of Sensitive Information Before Storage or Transfer in HashiCorp Vault |
Medium EPSS 0.91% |
< 1.6.6>= 1.7.0, < 1.7.4 | 1.6.61.7.4 |
| GHSA-fp52-qw33-mfmw Authentication Bypass by Spoofing and Insufficient Verification of Data Authenticity in Hashicorp Vault |
High EPSS 1.51% |
>= 1.5.0, < 1.5.1 | 1.5.1 |
| GHSA-fp52-qw33-mfmw Authentication Bypass by Spoofing and Insufficient Verification of Data Authenticity in Hashicorp Vault |
High EPSS 1.51% |
>= 1.4.0, < 1.4.4 | 1.4.4 |
| GHSA-fp52-qw33-mfmw Authentication Bypass by Spoofing and Insufficient Verification of Data Authenticity in Hashicorp Vault |
High EPSS 1.51% |
>= 1.3.0, < 1.3.8 | 1.3.8 |
| GHSA-fp52-qw33-mfmw Authentication Bypass by Spoofing and Insufficient Verification of Data Authenticity in Hashicorp Vault |
High EPSS 1.51% |
>= 0.8.1, < 1.2.5 | 1.2.5 |
| GHSA-fp52-qw33-mfmw Authentication Bypass by Spoofing and Insufficient Verification of Data Authenticity in Hashicorp Vault |
High EPSS 1.51% |
>= 0.8.1, < 1.2.5>= 1.3.0, < 1.3.8>= 1.4.0, < 1.4.4>= 1.5.0, < 1.5.1 | 1.2.51.3.81.4.41.5.1 |
| GHSA-9vh5-r4qw-v3vv Improper Resource Shutdown or Release in HashiCorp Vault |
High EPSS 1.42% |
>= 0.11.0, < 1.3.2 | 1.3.2 |
| GHSA-9vh5-r4qw-v3vv Improper Resource Shutdown or Release in HashiCorp Vault |
High EPSS 1.42% |
>= 0.11.0, < 1.3.2 | 1.3.2 |
| GHSA-38j9-7pp9-2hjw Invalid session token expiration |
High EPSS 1.38% |
>= 1.7.0, < 1.7.2 | 1.7.2 |
| GHSA-38j9-7pp9-2hjw Invalid session token expiration |
High EPSS 1.38% |
>= 0.10.0, < 1.5.9>= 1.6.0, < 1.6.5>= 1.7.0, < 1.7.2 | 1.5.91.6.51.7.2 |
| GHSA-38j9-7pp9-2hjw Invalid session token expiration |
High EPSS 1.38% |
>= 1.6.0, < 1.6.5 | 1.6.5 |
| GHSA-38j9-7pp9-2hjw Invalid session token expiration |
High EPSS 1.38% |
>= 0.10.0, < 1.5.9 | 1.5.9 |
| GHSA-25xj-89g5-fm6h Information Disclosure in HashiCorp Vault |
High EPSS 1.26% |
>= 1.3.0, < 1.3.6 | 1.3.6 |
| GHSA-25xj-89g5-fm6h Information Disclosure in HashiCorp Vault |
High EPSS 1.26% |
>= 1.4.0, < 1.4.2 | 1.4.2 |
| GHSA-25xj-89g5-fm6h Information Disclosure in HashiCorp Vault |
High EPSS 1.26% |
>= 1.3.0, < 1.3.6>= 1.4.0, < 1.4.2 | 1.3.61.4.2 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor