CVE-2022-40186
Critical
Description
An issue was discovered in HashiCorp Vault and Vault Enterprise before 1.11.3. A vulnerability in the Identity Engine was found where, in a deployment where an entity has multiple mount accessors with shared alias names, Vault may overwrite metadata to the wrong alias due to an issue with checking the proper alias assigned to an entity. This may allow for unintended access to key/value paths using that metadata in Vault.
SeverityCritical
CVSS9.1
Exploit probability—
Product
Hashicorp Vault
PublishedSep 22, 2022
First seenSep 22, 2022
How to fix
Update
- hashicorp vault1.9.9, 1.10.6, 1.11.3 or later
- github.com/hashicorp/vault1.11.3, 1.10.6, 1.9.9 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| hashicorp vault | 1.8.0 ≤ v < 1.9.9, 1.10.0 ≤ v < 1.10.6, 1.11.0 ≤ v < 1.11.3 | 1.9.9, 1.10.6, 1.11.3 |
| github.com/hashicorp/vaultGo | 1.11.0 ≤ v < 1.11.3, 1.10.0 ≤ v < 1.10.6, 1.8.0 ≤ v < 1.9.9 | 1.11.3, 1.10.6, 1.9.9 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.