HashiCorp Vault vulnerabilities

HashiCorp Vault and Vault Enterprise have a vulnerability allowing an authenticated attacker to manipulate an identity value referenced by a templated policy path to gain unintended access. Slash characters can be interpreted as additional path segments. Fixed in Vault CE 2.0.4 and Enterprise 2.0.4, 1.21.9, 1.20.14, 1.19.20.

In HashiCorp Vault and Vault Enterprise prior to version 2.0.1, the audit device validation logic did not consistently apply plugin directory protections when the legacy file audit path option was used. This vulnerability is fixed in versions 2.0.1, 1.21.6, 1.20.11, and 1.19.17.

An authenticated user with access to a kvv2 path through a policy containing a glob may delete secrets they were not authorized to read or write, causing denial-of-service. This vulnerability does not allow cross-namespace deletion or reading of secret data.

A malicious user may submit a specially-crafted complex payload that otherwise meets the default request size limit which results in excessive memory and CPU consumption of Vault. This may lead to a timeout in Vault's auditing subroutine, potentially resulting in the Vault server to become unresponsive.