CVE-2021-42135: High severity HashiCorp Vault vulnerability
HashiCorp Vault and Vault Enterprise 1.8.x through 1.8.4 may have an unexpected interaction between glob-related policies and the Google Cloud secrets engine. Users may, in some situations, have more privileges than intended, e.g., a user with read permission for the /gcp/roleset/ path may be able to issue Google Cloud service account credentials.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2021-42135.
What is the severity of CVE-2021-42135?
The severity of CVE-2021-42135 is high with a severity value of 8.1.
Which versions of HashiCorp Vault are affected by CVE-2021-42135?
HashiCorp Vault and Vault Enterprise versions 1.8.0 through 1.8.4 are affected by CVE-2021-42135.
What is the impact of CVE-2021-42135?
The vulnerability may result in users having more privileges than intended in certain situations.
Is there a fix available for CVE-2021-42135?
It is recommended to upgrade to a version of HashiCorp Vault that is not affected, such as version 1.8.5 or later.