CVE-2020-16251 | BDVDB-2026-140677 Detail

Description#

HashiCorp Vault and Vault Enterprise versions 0.8.3 and newer, when configured with the GCP GCE auth method, may be vulnerable to authentication bypass. Fixed in 1.2.5, 1.3.8, 1.4.4, and 1.5.1.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

https://www.hashicorp.com/blog/category/vault/
https://github.com/hashicorp/vault/blob/master/CHANGELOG.md#151
http://packetstormsecurity.com/files/159479/Hashicorp-Vault-GCP-IAM-Integration-Authentication-Bypass.html

Exploit#

No public exploit known

History#

Version 12020-08-26Record published in the CVE List.
Version 22024-08-04Most recent update recorded in the CVE List.