Start for Free
go

github.com/hashicorp/vault

View on go registry
100 Total advisories
100 Vulnerabilities
0 Malware

Dependency scanning

Check whether github.com/hashicorp/vault is in your codebase

Corgea flags malicious and compromised dependencies with reachability analysis, so you fix the packages that actually run in your application instead of working through the whole lockfile.

Explore dependency scanning Explore AI SAST →

Vulnerabilities

HIGH 8.1
Go

CVE-2026-3605

HashiCorp Vault has a KVv2 Metadata and Secret Deletion Policy Bypass that leads to Denial-of-Service
MEDIUM 5.3
Go

CVE-2026-5052

HashiCorp Vault has Server-Side Request Forgery in ACME Challenge Validation via Attacker-Controlled DNS
HIGH 7.5
Go

CVE-2025-12044

Hashicorp Vault and Vault Enterprise vulnerable to a denial of service when processing JSON
HIGH 7.5
Go

CVE-2025-6203

HashiCorp Vault Community Edition Denial of Service Though Complex JSON Payloads
MEDIUM 4.5
Go

CVE-2025-4166

Hashicorp Vault Community vulnerable to Generation of Error Message Containing Sensitive Information
HIGH 7.5
Go

CVE-2026-5807

HashiCorp Vault Vulnerable to Denial-of-Service via Unauthenticated Root Token Generation/Rekey Operations
HIGH 7.5
Go

CVE-2026-4525

HashiCorp Vault May Expose Tokens to Auth Plugins Due to Incorrect Header Sanitization
HIGH 8.1
Go

CVE-2025-11621

HashiCorp Vault and Vault Enterprise's AWS Auth method may be susceptible to authentication bypass
MEDIUM 6.5
Go

CVE-2025-6014

Hashicorp Vault's TOTP Secrets Engine Susceptible to Code Reuse

MEDIUM 5.7
Go

CVE-2025-6015

Hashicorp Vault has Login MFA Rate Limit Bypass Vulnerability
CRITICAL 9.1
Go

CVE-2025-6000

Hashicorp Vault has Code Execution Vulnerability via Plugin Configuration
MEDIUM 5.3
Go

CVE-2025-6004

Hashicorp Vault has Lockout Feature Authentication Bypass
LOW 3.7
Go

CVE-2025-6011

Hashicorp Vault has an Observable Discrepancy on Existing and Non-Existing Users
MEDIUM 6.5
Go

CVE-2025-6013

HashiCorp Vault ldap auth method may not have correctly enforced MFA
HIGH 7.2
Go

CVE-2025-5999

Hashicorp Vault has Privilege Escalation Vulnerability
MEDIUM 6.8
Go

CVE-2025-6037

Hashicorp Vault has Incorrect Validation for Non-CA Certificates
LOW 3.1
Go

CVE-2025-4656

Vault Community Edition rekey and recovery key operations can cause denial of service
HIGH 7.5
Go

CVE-2024-8185

Hashicorp Vault vulnerable to denial of service through memory exhaustion
HIGH 7.5
Go

CVE-2024-7594

Vault SSH Secrets Engine Configuration Did Not Restrict Valid Principals By Default
MEDIUM 6.5
Go

CVE-2024-8365

Vault Leaks Client Token and Token Accessor in Audit Devices
HIGH 7.5
Go

CVE-2024-6468

Hashicorp Vault vulnerable to Improper Check or Handling of Exceptional Conditions

MEDIUM 6.4
Go

CVE-2024-2660

HashiCorpVault does not correctly validate OCSP responses
HIGH 8.1
Go

CVE-2024-2048

Incorrect TLS certificate auth method in Vault
HIGH 7.5
Go

CVE-2023-5954

HashiCorp Vault Missing Release of Memory after Effective Lifetime vulnerability
HIGH 7.6
Go

CVE-2023-5077

Hashicorp Vault Incorrect Permission Assignment for Critical Resource vulnerability
MEDIUM 5.3
Go

CVE-2023-3462

HashiCorp Vault and Vault Enterprise vulnerable to user enumeration
MEDIUM 5.3
Go

CVE-2022-41316

HashiCorp Vault's revocation list not respected
HIGH 8.1
Go

CVE-2023-24999

Hashicorp Vault Fails to Verify if Approle SecretID Belongs to Role During a Destroy Operation
MEDIUM 4.7
Go

CVE-2023-25000

HashiCorp Vault's implementation of Shamir's secret sharing vulnerable to cache-timing attacks
MEDIUM 6.7
Go

CVE-2023-0620

HashiCorp Vault’s Microsoft SQL Database Storage Backend Vulnerable to SQL Injection Via Configuration File
MEDIUM 4.3
Go

CVE-2023-2121

Hashicorp Vault vulnerable to Cross-site Scripting
MEDIUM 6.5
Go

CVE-2023-0665

HashiCorp Vault's PKI mount vulnerable to denial of service
HIGH 7.4
Go

CVE-2021-32923

Invalid session token expiration

LOW 2.9
Go

CVE-2021-41802

Hashicorp Vault Privilege Escalation Vulnerability
HIGH 8.2
Go

CVE-2020-16250

Authentication Bypass by Spoofing and Insufficient Verification of Data Authenticity in Hashicorp Vault
MEDIUM 5.3
Go

CVE-2021-38554

Improper Removal of Sensitive Information Before Storage or Transfer in HashiCorp Vault
UNKNOWN
Go

CVE-2024-5798

HashiCorp Vault Incorrectly Validated JSON Web Tokens (JWT) Audience Claims in github.com/hashicorp/vault
UNKNOWN
Go

CVE-2023-4680

HashiCorp Vault Improper Input Validation vulnerability in github.com/hashicorp/vault
MEDIUM 6.8
Go

CVE-2023-4680

HashiCorp Vault Improper Input Validation vulnerability
LOW 2.6
Go

CVE-2024-5798

HashiCorp Vault Incorrectly Validated JSON Web Tokens (JWT) Audience Claims
UNKNOWN
Go

CVE-2025-4166

Hashicorp Vault Community vulnerable to Generation of Error Message Containing Sensitive Information in github.com/hashicorp/vault
UNKNOWN
Go

CVE-2024-8185

Hashicorp Vault vulnerable to denial of service through memory exhaustion in github.com/hashicorp/vault
UNKNOWN
Go

CVE-2024-9180

Vault Community Edition privilege escalation vulnerability in github.com/hashicorp/vault
HIGH 7.2
Go

CVE-2024-9180

Vault Community Edition privilege escalation vulnerability
UNKNOWN
Go

CVE-2024-7594

Vault SSH Secrets Engine Configuration Did Not Restrict Valid Principals By Default in github.com/hashicorp/vault
UNKNOWN
Go

CVE-2026-4525

HashiCorp Vault May Expose Tokens to Auth Plugins Due to Incorrect Header Sanitization in github.com/hashicorp/vault
UNKNOWN
Go

CVE-2026-5807

HashiCorp Vault Vulnerable to Denial-of-Service via Unauthenticated Root Token Generation/Rekey Operations in github.com/hashicorp/vault
UNKNOWN
Go

CVE-2026-5052

HashiCorp Vault has Server-Side Request Forgery in ACME Challenge Validation via Attacker-Controlled DNS in github.com/hashicorp/vault
UNKNOWN
Go

CVE-2026-3605

HashiCorp Vault has a KVv2 Metadata and Secret Deletion Policy Bypass that leads to Denial-of-Service in github.com/hashicorp/vault
UNKNOWN
Go

CVE-2020-25816

Token leases could outlive their TTL in HashiCorp Vault in github.com/hashicorp/vault
UNKNOWN
Go

CVE-2024-0831

Hashicorp Vault may expose sensitive log information in github.com/hashicorp/vault
UNKNOWN
Go

CVE-2020-35177

Enumeration of users in HashiCorp Vault in github.com/hashicorp/vault
UNKNOWN
Go

CVE-2021-3282

Improper Authentication in HashiCorp Vault in github.com/hashicorp/vault
UNKNOWN
Go

CVE-2020-16251

HashiCorp Vault Authentication bypass in github.com/hashicorp/vault
UNKNOWN
Go

CVE-2020-10661

HashiCorp Vault Improper Privilege Management in github.com/hashicorp/vault
UNKNOWN
Go

CVE-2020-10660

HashiCorp Vault Improper Privilege Management in github.com/hashicorp/vault
UNKNOWN
Go

CVE-2022-40186

HashiCorp Vault vulnerable to incorrect metadata access in github.com/hashicorp/vault
UNKNOWN
Go

CVE-2020-7220

Improper Resource Shutdown or Release in HashiCorp Vault in github.com/hashicorp/vault
UNKNOWN
Go

CVE-2020-13223

Information Disclosure in HashiCorp Vault in github.com/hashicorp/vault
UNKNOWN
Go

CVE-2021-38553

HashiCorp Vault underlying database had excessively broad filesystem permissions from v1.4.0 until v1.8.0 in github.com/hashicorp/vault
UNKNOWN
Go

CVE-2021-43998

HashiCorp Vault Incorrect Permission Assignment for Critical Resource in github.com/hashicorp/vault
UNKNOWN
Go

CVE-2022-30689

HashiCorp Vault improper configuration of multi factor authentication in github.com/hashicorp/vault
UNKNOWN
Go

CVE-2021-42135

Incorrect Privilege Assignment in HashiCorp Vault in github.com/hashicorp/vault
UNKNOWN
Go

CVE-2025-6015

Hashicorp Vault has Login MFA Rate Limit Bypass Vulnerability in github.com/hashicorp/vault
UNKNOWN
Go

CVE-2025-11621

HashiCorp Vault and Vault Enterprise's AWS Auth method may be susceptible to authentication bypass in github.com/hashicorp/vault
UNKNOWN
Go

CVE-2025-6014

Hashicorp Vault's TOTP Secrets Engine Susceptible to Code Reuse in github.com/hashicorp/vault
UNKNOWN
Go

CVE-2025-12044

Hashicorp Vault and Vault Enterprise vulnerable to a denial of service when processing JSON in github.com/hashicorp/vault
UNKNOWN
Go

CVE-2024-2048

Authentication bypass in github.com/hashicorp/vault
UNKNOWN
Go

CVE-2023-0665

HashiCorp Vault's PKI mount vulnerable to denial of service in github.com/hashicorp/vault
UNKNOWN
Go

CVE-2023-3462

HashiCorp Vault and Vault Enterprise vulnerable to user enumeration in github.com/hashicorp/vault
UNKNOWN
Go

CVE-2024-8365

Vault Leaks Client Token and Token Accessor in Audit Devices in github.com/hashicorp/vault
UNKNOWN
Go

CVE-2025-6203

HashiCorp Vault Community Edition Denial of Service Though Complex JSON Payloads in github.com/hashicorp/vault
UNKNOWN
Go

CVE-2023-0620

HashiCorp Vault’s Microsoft SQL Database Storage Backend Vulnerable to SQL Injection Via Configuration File in github.com/hashicorp/vault
UNKNOWN
Go

CVE-2023-5954

HashiCorp Vault Missing Release of Memory after Effective Lifetime vulnerability in github.com/hashicorp/vault
UNKNOWN
Go

CVE-2023-25000

Cache-timing attacks in Shamir's secret sharing in github.com/hashicorp/vault
UNKNOWN
Go

CVE-2020-16250

Authentication Bypass by Spoofing and Insufficient Verification of Data Authenticity in Hashicorp Vault in github.com/hashicorp/vault
UNKNOWN
Go

CVE-2025-5999

Hashicorp Vault has Privilege Escalation Vulnerability in github.com/hashicorp/vault
UNKNOWN
Go

CVE-2024-2660

HashiCorpVault does not correctly validate OCSP responses in github.com/hashicorp/vault
UNKNOWN
Go

CVE-2025-6011

Hashicorp Vault has an Observable Discrepancy on Existing and Non-Existing Users in github.com/hashicorp/vault
UNKNOWN
Go

CVE-2025-6000

Hashicorp Vault has Code Execution Vulnerability via Plugin Configuration in github.com/hashicorp/vault
UNKNOWN
Go

CVE-2025-6013

HashiCorp Vault ldap auth method may not have correctly enforced MFA in github.com/hashicorp/vault
UNKNOWN
Go

CVE-2022-41316

HashiCorp Vault's revocation list not respected in github.com/hashicorp/vault
UNKNOWN
Go

CVE-2021-41802

Hashicorp Vault Privilege Escalation Vulnerability in github.com/hashicorp/vault
UNKNOWN
Go

CVE-2021-32923

Invalid session token expiration in github.com/hashicorp/vault
UNKNOWN
Go

CVE-2023-2121

Hashicorp Vault vulnerable to Cross-site Scripting in github.com/hashicorp/vault
UNKNOWN
Go

CVE-2025-4656

Vault Community Edition rekey and recovery key operations can cause denial of service in github.com/hashicorp/vault
UNKNOWN
Go

CVE-2021-38554

Improper Removal of Sensitive Information Before Storage or Transfer in HashiCorp Vault in github.com/hashicorp/vault
UNKNOWN
Go

CVE-2025-6037

Hashicorp Vault has Incorrect Validation for Non-CA Certificates in github.com/hashicorp/vault
UNKNOWN
Go

CVE-2023-5077

Hashicorp Vault Incorrect Permission Assignment for Critical Resource vulnerability in github.com/hashicorp/vault
UNKNOWN
Go

CVE-2024-6468

Hashicorp Vault vulnerable to Improper Check or Handling of Exceptional Conditions in github.com/hashicorp/vault
UNKNOWN
Go

CVE-2023-24999

Hashicorp Vault Fails to Verify if Approle SecretID Belongs to Role During a Destroy Operation in github.com/hashicorp/vault
UNKNOWN
Go

CVE-2025-6004

Hashicorp Vault has Lockout Feature Authentication Bypass in github.com/hashicorp/vault
CRITICAL 9.8
Go

CVE-2020-25816

Token leases could outlive their TTL in HashiCorp Vault
CRITICAL 9.1
Go

CVE-2022-40186

HashiCorp Vault vulnerable to incorrect metadata access
UNKNOWN
Go

CVE-2025-3879

Hashicorp Vault Community vulnerable to Incorrect Authorization in github.com/hashicorp/vault
MEDIUM 6.6
Go

CVE-2025-3879

Hashicorp Vault Community vulnerable to Incorrect Authorization
HIGH 7.5
Go

CVE-2023-6337

Memory exhaustion in HashiCorp Vault
MEDIUM 5.3
Go

CVE-2020-10660

HashiCorp Vault Improper Privilege Management
HIGH 8.2
Go

CVE-2020-16251

HashiCorp Vault Authentication bypass
CRITICAL 9.1
Go

CVE-2020-10661

HashiCorp Vault Improper Privilege Management

Browse more Go advisories

Learn What is SAST?

Static Application Security Testing finds vulnerabilities like this one in source code before it ships. Read the guide →

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes