EUVD-2026-23345
GHSA-72gw-fmmr-c4r4
CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionNVD
If a Vault auth mount is configured to pass through the "Authorization" header, and the "Authorization" header is used to authenticate to Vault, Vault forwarded the Vault token to the auth plugin backend. Fixed in 2.0.0, 1.21.5, 1.20.10, and 1.19.16.
AnalysisAI
HashiCorp Vault exposes authentication tokens to auth plugin backends when auth mounts are configured to pass through the 'Authorization' header. Authenticated attackers with low privileges can potentially capture Vault tokens that should remain confidential, leading to credential theft and privilege escalation. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: inventory all HashiCorp Vault deployments and identify instances running versions 0.11.2-1.19.15, 1.20.0-1.20.9, 1.21.0-1.21.4, or pre-2.0.0 releases; verify auth mount configurations for 'Authorization' header pass-through settings. Within 7 days: upgrade to patched versions (2.0.0, 1.21.5, 1.20.10, or 1.19.16 per your release line); prioritize systems with auth plugins enabled and header pass-through active. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today