Vulnerability · Published Sep 22, 2022 · Assigned by mitre
CVE-2022-40186
Critical 9.1
In plain English
A critical-severity authorization bypass via user-controlled key in the github.com/hashicorp/vault package (Go). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 63% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
An issue was discovered in HashiCorp Vault and Vault Enterprise before 1.11.3. A vulnerability in the Identity Engine was found where, in a deployment where an entity has multiple mount accessors with shared alias names, Vault may overwrite metadata to the wrong alias due to an issue with checking the proper alias assigned to an entity. This may allow for unintended access to key/value paths using that metadata in Vault.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/hashicorp/vault | 1.11.3 | GHSA-7cgv-v83v-rr87 |
| Go | github.com/hashicorp/vault | 1.10.6 | GHSA-7cgv-v83v-rr87 |
| Go | github.com/hashicorp/vault | 1.9.9 | GHSA-7cgv-v83v-rr87 |
| Go | github.com/hashicorp/vault | 1.10.6, 1.11.3, 1.9.9 | GO-2022-1021 |
Affected products (as reported)
Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N