CRITICAL9.8Go
GHSA-23fq-q7hc-993r· BIT-vault-2021-38553, CVE-2021-38553HashiCorp Vault underlying database had excessively broad filesystem permissions from v1.4.0 until v1.8.0
Modified: 8/21/2024
package
Go/github.com/hashicorp/vault
pkg:go/github.com/hashicorp/vault
HIGH7.5Go
GHSA-25xj-89g5-fm6h· BIT-vault-2020-13223, CVE-2020-13223Information Disclosure in HashiCorp Vault
Modified: 8/21/2024
HIGH7.5Go
GHSA-2qmw-pvf7-4mw6· BIT-vault-2024-6468, CVE-2024-6468Hashicorp Vault vulnerable to Improper Check or Handling of Exceptional Conditions
Modified: 9/10/2026
LOW2.6Go
GHSA-32cj-5wx4-gq8p· BIT-vault-2024-5798, CVE-2024-5798HashiCorp Vault Incorrectly Validated JSON Web Tokens (JWT) Audience Claims
Modified: 8/7/2026
HIGH8.1Go
GHSA-362v-wg5p-64w2· BIT-vault-2021-42135, CVE-2021-42135Incorrect Privilege Assignment in HashiCorp Vault
Modified: 8/21/2024
HIGH7.4Go
GHSA-38j9-7pp9-2hjw· BIT-vault-2021-32923, CVE-2021-32923Invalid session token expiration
Modified: 9/10/2026
HIGH8.2Go
GHSA-4mp7-2m29-gqxf· BIT-vault-2020-16251, CVE-2020-16251HashiCorp Vault Authentication bypass
Modified: 9/16/2024
HIGH7.5Go
GHSA-4qhc-v8r6-8vwm· BIT-vault-2023-5954, CVE-2023-5954HashiCorp Vault Missing Release of Memory after Effective Lifetime vulnerability
Modified: 9/10/2026
CRITICAL9.8Go
GHSA-57gg-cj55-q5g2· BIT-vault-2020-25816, CVE-2020-25816Token leases could outlive their TTL in HashiCorp Vault
Modified: 2/3/2026
MEDIUM5.3Go
GHSA-6239-28c2-9mrm· BIT-vault-2021-38554, CVE-2021-38554Improper Removal of Sensitive Information Before Storage or Transfer in HashiCorp Vault
Modified: 9/10/2026
MEDIUM6.8Go
GHSA-6c5r-4wfc-3mcx· BIT-vault-2025-6037, CVE-2025-6037Hashicorp Vault has Incorrect Validation for Non-CA Certificates
Modified: 9/10/2026
HIGH7.2Go
GHSA-6h4p-m86h-hhgh· BIT-vault-2025-5999, CVE-2025-5999Hashicorp Vault has Privilege Escalation Vulnerability
Modified: 9/10/2026
HIGH7.5Go
GHSA-6p62-6cg9-f5f5· BIT-vault-2023-6337, CVE-2023-6337Memory exhaustion in HashiCorp Vault
Modified: 2/13/2025
HIGH7.5Go
GHSA-72gw-fmmr-c4r4· BIT-vault-2026-4525, CVE-2026-4525HashiCorp Vault May Expose Tokens to Auth Plugins Due to Incorrect Header Sanitization
Modified: 9/10/2026
CRITICAL9.1Go
GHSA-7cgv-v83v-rr87· BIT-vault-2022-40186, CVE-2022-40186HashiCorp Vault vulnerable to incorrect metadata access
Modified: 5/28/2025
MEDIUM6.5Go
GHSA-7rx2-769v-hrwf· BIT-vault-2025-6013, CVE-2025-6013HashiCorp Vault ldap auth method may not have correctly enforced MFA
Modified: 9/10/2026
HIGH7.6Go
GHSA-86c6-3g63-5w64· BIT-vault-2023-5077, CVE-2023-5077Hashicorp Vault Incorrect Permission Assignment for Critical Resource vulnerability
Modified: 9/10/2026
HIGH7.5Go
GHSA-88v5-9hxc-f85r· BIT-vault-2026-5807, CVE-2026-5807HashiCorp Vault Vulnerable to Denial-of-Service via Unauthenticated Root Token Generation/Rekey Operations
Modified: 9/10/2026
HIGH7.5Go
GHSA-8f82-53h8-2p34· BIT-vault-2025-6203, CVE-2025-6203HashiCorp Vault Community Edition Denial of Service Though Complex JSON Payloads
Modified: 9/10/2026
MEDIUM5.3Go
GHSA-8r5m-3f66-qpr3· BIT-vault-2026-5052, CVE-2026-5052HashiCorp Vault has Server-Side Request Forgery in ACME Challenge Validation via Attacker-Controlled DNS
Modified: 9/10/2026
HIGH8.1Go
GHSA-9g4h-h484-3578· BIT-vault-2025-11621, CVE-2025-11621HashiCorp Vault and Vault Enterprise's AWS Auth method may be susceptible to authentication bypass
Modified: 9/10/2026
MEDIUM5.3Go
GHSA-9mh8-9j64-443f· BIT-vault-2022-41316, CVE-2022-41316HashiCorp Vault's revocation list not respected
Modified: 9/10/2026
MEDIUM5.3Go
GHSA-9v3w-w2jh-4hff· BIT-vault-2023-3462, CVE-2023-3462HashiCorp Vault and Vault Enterprise vulnerable to user enumeration
Modified: 9/10/2026
HIGH7.5Go
GHSA-9vh5-r4qw-v3vv· BIT-vault-2020-7220, CVE-2020-7220Improper Resource Shutdown or Release in HashiCorp Vault
Modified: 8/21/2024
MEDIUM5.3Go
GHSA-c5wc-v287-82pc· BIT-vault-2022-30689, CVE-2022-30689HashiCorp Vault improper configuration of multi factor authentication
Modified: 8/21/2024
MEDIUM6.6Go
GHSA-f9ch-h8j7-8jwg· BIT-vault-2025-3879, CVE-2025-3879Hashicorp Vault Community vulnerable to Incorrect Authorization
Modified: 5/7/2025
LOW3.1Go
GHSA-fhc2-8qx8-6vj7· BIT-vault-2025-4656, CVE-2025-4656Vault Community Edition rekey and recovery key operations can cause denial of service
Modified: 9/10/2026
HIGH8.2Go
GHSA-fp52-qw33-mfmw· BIT-vault-2020-16250, CVE-2020-16250Authentication Bypass by Spoofing and Insufficient Verification of Data Authenticity in Hashicorp Vault
Modified: 9/10/2026
HIGH7.5Go
GHSA-g233-2p4r-3q7v· BIT-openbao-2024-8185, BIT-vault-2024-8185Hashicorp Vault vulnerable to denial of service through memory exhaustion
Modified: 9/10/2026
MEDIUM4.5Go
GHSA-gcqf-f89c-68hv· BIT-openbao-2025-4166, BIT-vault-2025-4166Hashicorp Vault Community vulnerable to Generation of Error Message Containing Sensitive Information
Modified: 9/10/2026
MEDIUM4.3Go
GHSA-gq98-53rq-qr5h· BIT-vault-2023-2121, CVE-2023-2121Hashicorp Vault vulnerable to Cross-site Scripting
Modified: 9/10/2026
MEDIUM6.5Go
GHSA-hwc3-3qh6-r4gg· BIT-vault-2023-0665, CVE-2023-0665HashiCorp Vault's PKI mount vulnerable to denial of service
Modified: 9/10/2026
MEDIUM6.4Go
GHSA-j2rp-gmqv-frhv· BIT-vault-2024-2660, CVE-2024-2660HashiCorpVault does not correctly validate OCSP responses
Modified: 9/10/2026
CRITICAL9.1Go
GHSA-j6vv-vv26-rh7c· BIT-vault-2020-10661, CVE-2020-10661HashiCorp Vault Improper Privilege Management
Modified: 9/16/2024
HIGH7.5Go
GHSA-jg74-mwgw-v6x3· BIT-openbao-2024-7594, BIT-vault-2024-7594Vault SSH Secrets Engine Configuration Did Not Restrict Valid Principals By Default
Modified: 9/10/2026
MEDIUM6.5Go
GHSA-jjxf-26c9-77gm· BIT-vault-2024-8365, CVE-2024-8365Vault Leaks Client Token and Token Accessor in Audit Devices
Modified: 9/10/2026
HIGH8.1Go
GHSA-m2w4-8ggf-rj47· BIT-vault-2026-3605, CVE-2026-3605HashiCorp Vault has a KVv2 Metadata and Secret Deletion Policy Bypass that leads to Denial-of-Service
Modified: 9/10/2026
MEDIUM5.3Go
GHSA-m979-w9wj-qfj9· BIT-vault-2020-10660, CVE-2020-10660HashiCorp Vault Improper Privilege Management
Modified: 9/16/2024
CRITICAL9.1Go
GHSA-mr4h-qf9j-f665· BIT-vault-2025-6000, CVE-2025-6000Hashicorp Vault has Code Execution Vulnerability via Plugin Configuration
Modified: 9/10/2026
LOW3.7Go
GHSA-mwgr-84fv-3jh9· BIT-vault-2025-6011, CVE-2025-6011Hashicorp Vault has an Observable Discrepancy on Existing and Non-Existing Users
Modified: 9/10/2026
CRITICAL9.1Go
GHSA-pfmw-vj74-ph8g· BIT-vault-2021-43998, CVE-2021-43998HashiCorp Vault Incorrect Permission Assignment for Critical Resource
Modified: 8/21/2024
MEDIUM5.3Go
GHSA-qgj7-fmq2-6cc4· BIT-vault-2025-6004, CVE-2025-6004Hashicorp Vault has Lockout Feature Authentication Bypass
Modified: 9/10/2026
MEDIUM6.5Go
GHSA-qv3p-fmv3-9hww· BIT-vault-2025-6014, CVE-2025-6014Hashicorp Vault's TOTP Secrets Engine Susceptible to Code Reuse
Modified: 9/10/2026
LOW2.9Go
GHSA-qv95-g3gm-x542· BIT-vault-2021-41802, CVE-2021-41802Hashicorp Vault Privilege Escalation Vulnerability
Modified: 9/10/2026
HIGH8.1Go
GHSA-r3w7-mfpm-c2vw· BIT-vault-2024-2048, CVE-2024-2048Incorrect TLS certificate auth method in Vault
Modified: 9/10/2026
MEDIUM6.5Go
GHSA-rpgp-9hmg-j25x· BIT-vault-2020-35177, CVE-2020-35177Enumeration of users in HashiCorp Vault
Modified: 6/28/2024
HIGH7.5Go
GHSA-rq95-xf66-j689· BIT-vault-2021-3282, CVE-2021-3282Improper Authentication in HashiCorp Vault
Modified: 6/28/2024
HIGH7.2Go
GHSA-rr8j-7w34-xp5j· BIT-openbao-2024-9180, BIT-vault-2024-9180Vault Community Edition privilege escalation vulnerability
Modified: 7/27/2026
MEDIUM6.7Go
GHSA-v3hp-mcj5-pg39· BIT-vault-2023-0620, CVE-2023-0620HashiCorp Vault’s Microsoft SQL Database Storage Backend Vulnerable to SQL Injection Via Configuration File
Modified: 9/10/2026
MEDIUM5.7Go
GHSA-v6r4-35f9-9rpw· BIT-vault-2025-6015, CVE-2025-6015Hashicorp Vault has Login MFA Rate Limit Bypass Vulnerability
Modified: 9/10/2026
MEDIUM6.8Go
GHSA-v84f-6r39-cpfc· BIT-vault-2023-4680, CVE-2023-4680HashiCorp Vault Improper Input Validation vulnerability
Modified: 8/7/2026
MEDIUM4.5Go
GHSA-vgh3-mwxq-rcp8· BIT-vault-2024-0831, CVE-2024-0831Hashicorp Vault may expose sensitive log information
Modified: 6/28/2024
HIGH7.5Go
GHSA-vp5w-xcfc-73wf· BIT-vault-2025-12044, CVE-2025-12044Hashicorp Vault and Vault Enterprise vulnerable to a denial of service when processing JSON
Modified: 9/10/2026
MEDIUM4.7Go
GHSA-vq4h-9ghm-qmrr· BIT-vault-2023-25000, CVE-2023-25000HashiCorp Vault's implementation of Shamir's secret sharing vulnerable to cache-timing attacks
Modified: 9/10/2026
HIGH8.1Go
GHSA-wmg5-g953-qqfw· BIT-vault-2023-24999, CVE-2023-24999Hashicorp Vault Fails to Verify if Approle SecretID Belongs to Role During a Destroy Operation
Modified: 9/10/2026
—Go
GO-2022-0578· BIT-vault-2021-42135, CVE-2021-42135Incorrect Privilege Assignment in HashiCorp Vault in github.com/hashicorp/vault
Modified: 3/3/2026
—Go
GO-2022-0590· BIT-vault-2022-30689, CVE-2022-30689HashiCorp Vault improper configuration of multi factor authentication in github.com/hashicorp/vault
Modified: 3/3/2026
—Go
GO-2022-0611· BIT-vault-2021-43998, CVE-2021-43998HashiCorp Vault Incorrect Permission Assignment for Critical Resource in github.com/hashicorp/vault
Modified: 3/3/2026
—Go
GO-2022-0618· BIT-vault-2021-41802, CVE-2021-41802Hashicorp Vault Privilege Escalation Vulnerability in github.com/hashicorp/vault
Modified: 2/4/2026
—Go
GO-2022-0620· BIT-vault-2021-38553, CVE-2021-38553HashiCorp Vault underlying database had excessively broad filesystem permissions from v1.4.0 until v1.8.0 in github.com/hashicorp/vault
Modified: 3/3/2026
—Go
GO-2022-0623· BIT-vault-2021-32923, CVE-2021-32923Invalid session token expiration in github.com/hashicorp/vault
Modified: 2/4/2026
—Go
GO-2022-0632· BIT-vault-2021-38554, CVE-2021-38554Improper Removal of Sensitive Information Before Storage or Transfer in HashiCorp Vault in github.com/hashicorp/vault
Modified: 2/4/2026
—Go
GO-2022-0778· BIT-vault-2020-13223, CVE-2020-13223Information Disclosure in HashiCorp Vault in github.com/hashicorp/vault
Modified: 3/3/2026
—Go
GO-2022-0816· BIT-vault-2020-7220, CVE-2020-7220Improper Resource Shutdown or Release in HashiCorp Vault in github.com/hashicorp/vault
Modified: 3/3/2026
—Go
GO-2022-0825· BIT-vault-2020-16250, CVE-2020-16250Authentication Bypass by Spoofing and Insufficient Verification of Data Authenticity in Hashicorp Vault in github.com/hashicorp/vault
Modified: 2/4/2026
—Go
GO-2022-1021· BIT-vault-2022-40186, CVE-2022-40186HashiCorp Vault vulnerable to incorrect metadata access in github.com/hashicorp/vault
Modified: 3/3/2026
—Go
GO-2023-1685· BIT-vault-2023-0620, CVE-2023-0620HashiCorp Vault’s Microsoft SQL Database Storage Backend Vulnerable to SQL Injection Via Configuration File in github.com/hashicorp/vault
Modified: 2/4/2026
—Go
GO-2023-1708· BIT-vault-2023-0665, CVE-2023-0665HashiCorp Vault's PKI mount vulnerable to denial of service in github.com/hashicorp/vault
Modified: 2/4/2026
—Go
GO-2023-1709· BIT-vault-2023-25000, CVE-2023-25000Cache-timing attacks in Shamir's secret sharing in github.com/hashicorp/vault
Modified: 2/4/2026
—Go
GO-2023-1849· BIT-vault-2023-2121, CVE-2023-2121Hashicorp Vault vulnerable to Cross-site Scripting in github.com/hashicorp/vault
Modified: 2/4/2026
—Go
GO-2023-1897· BIT-vault-2022-41316, CVE-2022-41316HashiCorp Vault's revocation list not respected in github.com/hashicorp/vault
Modified: 2/4/2026
—Go
GO-2023-1900· BIT-vault-2023-24999, CVE-2023-24999Hashicorp Vault Fails to Verify if Approle SecretID Belongs to Role During a Destroy Operation in github.com/hashicorp/vault
Modified: 2/4/2026
—Go
GO-2023-1986· BIT-vault-2023-3462, CVE-2023-3462HashiCorp Vault and Vault Enterprise vulnerable to user enumeration in github.com/hashicorp/vault
Modified: 2/4/2026
—Go
GO-2023-2063· BIT-vault-2023-4680, CVE-2023-4680HashiCorp Vault Improper Input Validation vulnerability in github.com/hashicorp/vault
Modified: 8/7/2026
—Go
GO-2023-2088· BIT-vault-2023-5077, CVE-2023-5077Hashicorp Vault Incorrect Permission Assignment for Critical Resource vulnerability in github.com/hashicorp/vault
Modified: 2/4/2026
—Go
GO-2023-2329· BIT-vault-2023-5954, CVE-2023-5954HashiCorp Vault Missing Release of Memory after Effective Lifetime vulnerability in github.com/hashicorp/vault
Modified: 2/4/2026
—Go
GO-2023-2399· BIT-vault-2023-6337, CVE-2023-6337Denial of service via memory exhaustion in github.com/hashicorp/vault
Modified: 5/20/2024
—Go
GO-2024-2485· BIT-vault-2020-10661, CVE-2020-10661HashiCorp Vault Improper Privilege Management in github.com/hashicorp/vault
Modified: 3/3/2026
—Go
GO-2024-2486· BIT-vault-2020-10660, CVE-2020-10660HashiCorp Vault Improper Privilege Management in github.com/hashicorp/vault
Modified: 3/3/2026
—Go
GO-2024-2488· BIT-vault-2020-16251, CVE-2020-16251HashiCorp Vault Authentication bypass in github.com/hashicorp/vault
Modified: 3/3/2026
—Go
GO-2024-2508· BIT-vault-2020-35177, CVE-2020-35177Enumeration of users in HashiCorp Vault in github.com/hashicorp/vault
Modified: 3/3/2026
—Go
GO-2024-2509· BIT-vault-2021-3282, CVE-2021-3282Improper Authentication in HashiCorp Vault in github.com/hashicorp/vault
Modified: 3/3/2026
—Go
GO-2024-2511· BIT-vault-2024-0831, CVE-2024-0831Hashicorp Vault may expose sensitive log information in github.com/hashicorp/vault
Modified: 3/3/2026
—Go
GO-2024-2514· BIT-vault-2020-25816, CVE-2020-25816Token leases could outlive their TTL in HashiCorp Vault in github.com/hashicorp/vault
Modified: 3/3/2026
—Go
GO-2024-2617· BIT-vault-2024-2048, CVE-2024-2048Authentication bypass in github.com/hashicorp/vault
Modified: 2/4/2026
—Go
GO-2024-2690· BIT-vault-2024-2660, CVE-2024-2660HashiCorpVault does not correctly validate OCSP responses in github.com/hashicorp/vault
Modified: 2/4/2026
—Go
GO-2024-2921· BIT-vault-2024-5798, CVE-2024-5798HashiCorp Vault Incorrectly Validated JSON Web Tokens (JWT) Audience Claims in github.com/hashicorp/vault
Modified: 8/7/2026
—Go
GO-2024-2982· BIT-vault-2024-6468, CVE-2024-6468Hashicorp Vault vulnerable to Improper Check or Handling of Exceptional Conditions in github.com/hashicorp/vault
Modified: 2/4/2026
—Go
GO-2024-3113· BIT-vault-2024-8365, CVE-2024-8365Vault Leaks Client Token and Token Accessor in Audit Devices in github.com/hashicorp/vault
Modified: 2/4/2026
—Go
GO-2024-3162· BIT-openbao-2024-7594, BIT-vault-2024-7594Vault SSH Secrets Engine Configuration Did Not Restrict Valid Principals By Default in github.com/hashicorp/vault
Modified: 7/27/2026
—Go
GO-2024-3191· BIT-openbao-2024-9180, BIT-vault-2024-9180Vault Community Edition privilege escalation vulnerability in github.com/hashicorp/vault
Modified: 7/27/2026
—Go
GO-2024-3246· BIT-openbao-2024-8185, BIT-vault-2024-8185Hashicorp Vault vulnerable to denial of service through memory exhaustion in github.com/hashicorp/vault
Modified: 7/27/2026
—Go
GO-2025-3662· BIT-vault-2025-3879, CVE-2025-3879Hashicorp Vault Community vulnerable to Incorrect Authorization in github.com/hashicorp/vault
Modified: 5/7/2025
—Go
GO-2025-3663· BIT-openbao-2025-4166, BIT-vault-2025-4166Hashicorp Vault Community vulnerable to Generation of Error Message Containing Sensitive Information in github.com/hashicorp/vault
Modified: 7/27/2026
—Go
GO-2025-3788· BIT-vault-2025-4656, CVE-2025-4656Vault Community Edition rekey and recovery key operations can cause denial of service in github.com/hashicorp/vault
Modified: 2/4/2026
—Go
GO-2025-3836· BIT-vault-2025-6037, CVE-2025-6037Hashicorp Vault has Incorrect Validation for Non-CA Certificates in github.com/hashicorp/vault
Modified: 2/4/2026
—Go
GO-2025-3837· BIT-vault-2025-5999, CVE-2025-5999Hashicorp Vault has Privilege Escalation Vulnerability in github.com/hashicorp/vault
Modified: 2/4/2026
—Go
GO-2025-3838· BIT-vault-2025-6000, CVE-2025-6000Hashicorp Vault has Code Execution Vulnerability via Plugin Configuration in github.com/hashicorp/vault
Modified: 2/4/2026
—Go
GO-2025-3839· BIT-vault-2025-6011, CVE-2025-6011Hashicorp Vault has an Observable Discrepancy on Existing and Non-Existing Users in github.com/hashicorp/vault
Modified: 2/4/2026
—Go
GO-2025-3840· BIT-vault-2025-6004, CVE-2025-6004Hashicorp Vault has Lockout Feature Authentication Bypass in github.com/hashicorp/vault
Modified: 2/4/2026