CVE-2021-3024 | BDVDB-2026-148372 Detail

Description#

HashiCorp Vault and Vault Enterprise disclosed the internal IP address of the Vault node when responding to some invalid, unauthenticated HTTP requests. Fixed in 1.6.2 & 1.5.7.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

https://discuss.hashicorp.com/t/hcsec-2021-02-vault-api-endpoint-exposed-internal-ip-address-without-authentication/20334
https://security.gentoo.org/glsa/202207-01

Exploit#

No public exploit known

History#

Version 12021-02-01Record published in the CVE List.
Version 22024-08-03Most recent update recorded in the CVE List.