Vault Fails to Verify if the AppRole SecretID Belongs to Role During a Destroy Operation

CVE-2023-24999

What is CVE-2023-24999?

A security issue in HashiCorp Vault's approle authorization method allows any authenticated user with the ability to access the approle destroy endpoint to eliminate the secret ID of any other role. This is accomplished by passing the secret ID accessor, leading to potential unauthorized access and manipulation of sensitive credentials. It is crucial for users of affected Vault versions to upgrade to the patched releases to mitigate this risk.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References