Vault vulnerabilities

Vault's ACL policy engine did not consistently enforce a wildcard (glob) deny rule against LIST requests made with a trailing slash on the denied path. A token with a broader allow rule and a narrower wildcard deny rule may enumerate entry names beneath a path it was intended to be denied access to.

Vault is vulnerable to a denial-of-service condition where an unauthenticated attacker can repeatedly initiate or cancel root token generation or rekey operations, occupying the single in-progress operation slot. This prevents legitimate operators from completing these workflows.

A vulnerability in Vault allows the Vault token to be forwarded to the auth plugin backend when an auth mount is configured to pass through the 'Authorization' header. Fixed in versions 2.0.0, 1.21.5, 1.20.10, and 1.19.16.