Every CVE whose affected-product data names Hashicorp Vault, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.
CVEs (72)
CVE-2020-35192 — CVSS 9.8 (critical): The official vault docker images before 0.11.6 contain a blank password for a root user. System using the vault docker container deployed…
CVE-2020-12757 — CVSS 9.8 (critical): HashiCorp Vault and Vault Enterprise 1.4.0 and 1.4.1, when configured with the GCP Secrets Engine, may incorrectly generate GCP Credentials…
CVE-2022-36129 — CVSS 9.1 (critical): HashiCorp Vault Enterprise 1.7.0 through 1.9.7, 1.10.4, and 1.11.0 clusters using Integrated Storage expose an unauthenticated API endpoint…
CVE-2020-10661 — CVSS 9.1 (critical): HashiCorp Vault and Vault Enterprise versions 0.11.0 through 1.3.3 may, under certain circumstances, have existing nested-path policies…
CVE-2025-6000 — CVSS 9.1 (critical): A privileged Vault operator within the root namespace with write permission to {{sys/audit}} may obtain code execution on the underlying…
CVE-2022-40186 — CVSS 9.1 (critical): An issue was discovered in HashiCorp Vault and Vault Enterprise before 1.11.3. A vulnerability in the Identity Engine was found where, in a…
CVE-2020-16251 — CVSS 8.2 (high): HashiCorp Vault and Vault Enterprise versions 0.8.3 and newer, when configured with the GCP GCE auth method, may be vulnerable to…
CVE-2020-16250 — CVSS 8.2 (high): HashiCorp Vault and Vault Enterprise versions 0.7.1 and newer, when configured with the AWS IAM auth method, may be vulnerable to…
CVE-2021-42135 — CVSS 8.1 (high): HashiCorp Vault and Vault Enterprise 1.8.x through 1.8.4 may have an unexpected interaction between glob-related policies and the Google…
CVE-2026-3605 — CVSS 8.1 (high): An authenticated user with access to a kvv2 path through a policy containing a glob may be able to delete secrets they were not authorized…
CVE-2024-2048 — CVSS 8.1 (high): Vault and Vault Enterprise (“Vault”) TLS certificate auth method did not correctly validate client certificates when configured with a…
CVE-2018-19786 — CVSS 8.1 (high): HashiCorp Vault before 1.0.0 writes the master key to the server log in certain unusual or misconfigured scenarios in which incorrect data…
CVE-2025-11621 — CVSS 8.1 (high): Vault and Vault Enterprise’s (“Vault”) AWS Auth method may be susceptible to authentication bypass if the role of the configured…
CVE-2023-5077 — CVSS 7.6 (high): The Vault and Vault Enterprise ("Vault") Google Cloud secrets engine did not preserve existing Google Cloud IAM Conditions upon creating or…
CVE-2021-29653 — CVSS 7.5 (high): HashiCorp Vault and Vault Enterprise 1.5.1 and newer, under certain circumstances, may exclude revoked but unexpired certificates from the…
CVE-2021-3282 — CVSS 7.5 (high): HashiCorp Vault Enterprise 1.6.0 & 1.6.1 allowed the `remove-peer` raft operator command to be executed against DR secondaries without…
CVE-2024-8185 — CVSS 7.5 (high): Vault Community and Vault Enterprise (“Vault”) clusters using Vault’s Integrated Storage backend are vulnerable to a…
CVE-2024-7594 — CVSS 7.5 (high): Vault’s SSH secrets engine did not require the valid_principals list to contain a value by default. If the valid_principals and…
CVE-2024-6468 — CVSS 7.5 (high): Vault and Vault Enterprise did not properly handle requests originating from unauthorized IP addresses when the TCP listener option…
CVE-2023-6337 — CVSS 7.5 (high): HashiCorp Vault and Vault Enterprise 1.12.0 and newer are vulnerable to a denial of service through memory exhaustion of the host when…
CVE-2020-13223 — CVSS 7.5 (high): HashiCorp Vault and Vault Enterprise logged proxy environment variables that potentially included sensitive credentials. Fixed in 1.3.6 and…
CVE-2026-4525 — CVSS 7.5 (high): If a Vault auth mount is configured to pass through the "Authorization" header, and the "Authorization" header is used to authenticate to…
CVE-2025-6203 — CVSS 7.5 (high): A malicious user may submit a specially-crafted complex payload that otherwise meets the default request size limit which results in…
CVE-2026-5807 — CVSS 7.5 (high): Vault is vulnerable to a denial-of-service condition where an unauthenticated attacker can repeatedly initiate or cancel root token…
CVE-2020-7220 — CVSS 7.5 (high): HashiCorp Vault Enterprise 0.11.0 through 1.3.1 fails, in certain circumstances, to revoke dynamic secrets for a mount in a deleted…
CVE-2021-27400 — CVSS 7.5 (high): HashiCorp Vault and Vault Enterprise Cassandra integrations (storage backend and database secrets engine plugin) did not validate TLS…
CVE-2025-12044 — CVSS 7.5 (high): Vault and Vault Enterprise (“Vault”) are vulnerable to an unauthenticated denial of service when processing JSON payloads. This occurs…
CVE-2021-32923 — CVSS 7.4 (high): HashiCorp Vault and Vault Enterprise allowed the renewal of nearly-expired token leases and dynamic secret leases (specifically, those…
CVE-2024-9180 — CVSS 7.2 (high): A privileged Vault operator with write permissions to the root namespace’s identity endpoint could escalate their own or another user’s…
CVE-2025-5999 — CVSS 7.2 (high): A privileged Vault operator with write permissions to the root namespace’s identity endpoint could escalate their own or another user’s…
CVE-2023-4680 — CVSS 6.8 (medium): HashiCorp Vault and Vault Enterprise transit secrets engine allowed authorized users to specify arbitrary nonces, even with convergent…
CVE-2020-25816 — CVSS 6.8 (medium): HashiCorp Vault and Vault Enterprise versions 1.0 and newer allowed leases created with a batch token to outlive their TTL because…
CVE-2025-6037 — CVSS 6.8 (medium): Vault and Vault Enterprise (“Vault”) TLS certificate auth method did not correctly validate client certificates when configured with a…
CVE-2025-3879 — CVSS 6.6 (medium): Vault Community, Vault Enterprise (“Vault”) Azure Auth method did not correctly validate the claims in the Azure-issued token…
CVE-2025-6013 — CVSS 6.5 (medium): Vault and Vault Enterprise’s (“Vault”) ldap auth method may not have correctly enforced MFA if username_as_alias was set to true and…
CVE-2021-43998 — CVSS 6.5 (medium): HashiCorp Vault and Vault Enterprise 0.11.0 up to 1.7.5 and 1.8.4 templated ACL policies would always match the first-created entity alias…
CVE-2023-0665 — CVSS 6.5 (medium): HashiCorp Vault's PKI mount issuer endpoints did not correctly authorize access to remove an issuer or modify issuer metadata, potentially…
CVE-2025-6014 — CVSS 6.5 (medium): Vault and Vault Enterprise’s (“Vault”) TOTP Secrets Engine code validation endpoint is susceptible to code reuse within its validity…
CVE-2023-0620 — CVSS 6.5 (medium): HashiCorp Vault and Vault Enterprise versions 0.8.0 through 1.13.1 are vulnerable to an SQL injection attack when configuring the Microsoft…
CVE-2022-25244 — CVSS 6.5 (medium): Vault Enterprise clusters using the tokenization transform feature can expose the tokenization key through the tokenization key…
CVE-2022-25243 — CVSS 6.5 (medium): "Vault and Vault Enterprise 1.8.0 through 1.8.8, and 1.9.3 allowed the PKI secrets engine under certain configurations to issue wildcard…
CVE-2024-2660 — CVSS 6.4 (medium): Vault and Vault Enterprise TLS certificates auth method did not correctly validate OCSP responses when one or more OCSP sources were…
CVE-2024-8365 — CVSS 6.2 (medium): Vault Community Edition and Vault Enterprise experienced a regression where functionality that HMAC’d sensitive headers in the configured…
CVE-2023-5954 — CVSS 5.9 (medium): HashiCorp Vault and Vault Enterprise inbound client requests triggering a policy check can lead to an unbounded consumption of memory. A…
CVE-2025-6015 — CVSS 5.7 (medium): Vault and Vault Enterprise’s (“Vault”) login MFA rate limits could be bypassed and TOTP tokens could be reused. Fixed in Vault…
CVE-2024-2877 — CVSS 5.5 (medium): Vault Enterprise, when configured with performance standby nodes and a configured audit device, will inadvertently log request headers on…
CVE-2022-30689 — CVSS 5.3 (medium): HashiCorp Vault and Vault Enterprise from 1.10.0 to 1.10.2 did not correctly configure and enforce MFA on login after server restarts. This…
CVE-2023-3462 — CVSS 5.3 (medium): HashiCorp's Vault and Vault Enterprise are vulnerable to user enumeration when using the LDAP auth method. An attacker may submit requests…
CVE-2021-38554 — CVSS 5.3 (medium): HashiCorp Vault and Vault Enterprise’s UI erroneously cached and exposed user-viewed secrets between sessions in a single shared browser…
CVE-2021-3024 — CVSS 5.3 (medium): HashiCorp Vault and Vault Enterprise disclosed the internal IP address of the Vault node when responding to some invalid, unauthenticated…
CVE-2021-27668 — CVSS 5.3 (medium): HashiCorp Vault Enterprise 0.9.2 through 1.6.2 allowed the read of license metadata from DR secondaries without authentication. Fixed in…
CVE-2020-10660 — CVSS 5.3 (medium): HashiCorp Vault and Vault Enterprise versions 0.9.0 through 1.3.3 may, under certain circumstances, have an Entity's Group membership…
CVE-2020-35453 — CVSS 5.3 (medium): HashiCorp Vault Enterprise’s Sentinel EGP policy feature incorrectly allowed requests to be processed in parent and sibling namespaces…
CVE-2025-6004 — CVSS 5.3 (medium): Vault and Vault Enterprise’s (“Vault”) user lockout feature could be bypassed for Userpass and LDAP authentication methods. Fixed in…
CVE-2020-35177 — CVSS 5.3 (medium): HashiCorp Vault and Vault Enterprise 1.4.1 and newer allowed the enumeration of users via the LDAP auth method. Fixed in 1.5.6 and 1.6.1.
CVE-2020-25594 — CVSS 5.3 (medium): HashiCorp Vault and Vault Enterprise allowed for enumeration of Secrets Engine mount paths via unauthenticated HTTP requests. Fixed in…
CVE-2026-5052 — CVSS 5.3 (medium): Vault’s PKI engine’s ACME validation did not reject local targets when issuing http-01 and tls-alpn-01 challenges. This may lead to…
CVE-2022-41316 — CVSS 5.3 (medium): HashiCorp Vault and Vault Enterprise’s TLS certificate auth method did not initially load the optionally configured CRL issued by the…
CVE-2023-25000 — CVSS 5.0 (medium): HashiCorp Vault's implementation of Shamir's secret sharing used precomputed table lookups, and was vulnerable to cache-timing attacks. An…
CVE-2021-45042 — CVSS 4.9 (medium): In HashiCorp Vault and Vault Enterprise before 1.7.7, 1.8.x before 1.8.6, and 1.9.x before 1.9.1, clusters using the Integrated Storage…
CVE-2023-3774 — CVSS 4.9 (medium): An unhandled error in Vault Enterprise's namespace creation may cause the Vault process to crash, potentially resulting in denial of…
CVE-2025-4166 — CVSS 4.5 (medium): Vault Community and Vault Enterprise Key/Value (kv) Version 2 plugin may unintentionally expose sensitive information in server and audit…
CVE-2024-0831 — CVSS 4.5 (medium): Vault and Vault Enterprise (“Vault”) may expose sensitive information when enabling an audit device which specifies the `log_raw`…
CVE-2021-38553 — CVSS 4.4 (medium): HashiCorp Vault and Vault Enterprise 1.4.0 through 1.7.3 initialized an underlying database file associated with the Integrated Storage…
CVE-2023-24999 — CVSS 4.4 (medium): HashiCorp Vault and Vault Enterprise’s approle auth method allowed any authenticated user with access to an approle destroy endpoint to…
CVE-2023-2121 — CVSS 4.3 (medium): Vault and Vault Enterprise's (Vault) key-value v2 (kv-v2) diff viewer allowed HTML injection into the Vault web UI through key values. This…
CVE-2023-3775 — CVSS 4.2 (medium): A Vault Enterprise Sentinel Role Governing Policy created by an operator to restrict access to resources in one namespace can be applied to…
CVE-2025-6011 — CVSS 3.7 (low): A timing side channel in Vault and Vault Enterprise’s (“Vault”) userpass auth method allowed an attacker to distinguish between…
CVE-2025-4656 — CVSS 3.1 (low): Vault Community and Vault Enterprise rekey and recovery key operations can lead to a denial of service due to uncontrolled cancellation by…
CVE-2021-41802 — CVSS 2.9 (low): HashiCorp Vault and Vault Enterprise through 1.7.4 and 1.8.3 allowed a user with write permission to an entity alias ID sharing a mount…
CVE-2024-5798 — CVSS 2.6 (low): Vault and Vault Enterprise did not properly validate the JSON Web Token (JWT) role-bound audience claim when using the Vault JWT auth…
CVE-2023-2197 — CVSS 2.5 (low): HashiCorp Vault Enterprise 1.13.0 up to 1.13.1 is vulnerable to a padding oracle attack when using an HSM in conjunction with the…