Root Privileges Escalation Vulnerability in Vault

CVE-2024-9180

Summary

A privilege escalation vulnerability exists within HashiCorp Vault, where a Vault operator possessing write permissions to the root namespace's identity endpoint could potentially escalate their own privileges or those of another user to access Vault's root policy. This could lead to unauthorized access and control over sensitive data managed within Vault. The issue has been addressed in Vault Community Edition version 1.18.0 and Vault Enterprise versions 1.18.0, 1.17.7, 1.16.11, and 1.15.16, suggesting that users should promptly upgrade to these versions to mitigate risks.

References