GitHub Advisoryadvisory · Go

GHSA-rr8j-7w34-xp5j Vault Community Edition privilege escalation vulnerability

HIGH Published 2024-10-10 Modified 2025-08-04 Official page ↗
Aliases
CVE-2024-9180
Ecosystem
Go
Packages
github.com/hashicorp/vault, github.com/openbao/openbao
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-266
Reviewed
2024-10-10

Affected packages

• Go github.com/hashicorp/vault: < 1.18.0 → fixed in 1.18.0 • Go github.com/openbao/openbao: < 2.0.3 → fixed in 2.0.3

Description

A privileged Vault operator with write permissions to the root namespace’s identity endpoint could escalate their privileges to Vault’s root policy. Fixed in Vault Community Edition 1.18.0 and Vault Enterprise 1.18.0, 1.17.7, 1.16.11, and 1.15.16

Related

Alias · CVE (1)

  • CVE-2024-9180 A privileged Vault operator with write permissions to the root namespace’s identity endpoint could escalate their own or another user’s… vulnerability

Weakness · CWE (1)

  • CWE-266 Incorrect Privilege Assignment weakness

References