CVE-2024-9180: Vault Operators in Root Namespace May Elevate Their Privileges
A privileged Vault operator with write permissions to the root namespace’s identity endpoint could escalate their own or another user’s privileges to Vault’s root policy. Fixed in Vault Community Edition 1.18.0 and Vault Enterprise 1.18.0, 1.17.7, 1.16.11, and 1.15.16.
Other sources
A privileged Vault operator with write permissions to the root namespace’s identity endpoint could escalate their privileges to Vault’s root policy. Fixed in Vault Community Edition 1.18.0 and Vault Enterprise 1.18.0, 1.17.7, 1.16.11, and 1.15.16
— GitHub
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-9180?
CVE-2024-9180 is a critical vulnerability that allows a privileged Vault operator to escalate privileges.
How do I fix CVE-2024-9180?
To fix CVE-2024-9180, upgrade to Vault Community Edition version 1.18.0 or Vault Enterprise versions 1.18.0, 1.17.7, 1.16.11, or 1.15.16.
Who is affected by CVE-2024-9180?
CVE-2024-9180 affects Vault operators with write permissions to the root namespace’s identity endpoint.
What are the implications of CVE-2024-9180?
The implications of CVE-2024-9180 include potential unauthorized access to sensitive data and privilege escalation within the Vault.
When was CVE-2024-9180 disclosed?
CVE-2024-9180 was disclosed in 2024 and is associated with critical vulnerabilities in HashiCorp Vault.