CVE-2020-16250

high

Description

HashiCorp Vault and Vault Enterprise versions 0.7.1 and newer, when configured with the AWS IAM auth method, may be vulnerable to authentication bypass. Fixed in 1.2.5, 1.3.8, 1.4.4, and 1.5.1..

References

https://github.com/advisories/GHSA-fp52-qw33-mfmw

https://www.hashicorp.com/blog/category/vault/

https://github.com/hashicorp/vault/blob/master/CHANGELOG.md#151

https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-1705

http://packetstormsecurity.com/files/159478/Hashicorp-Vault-AWS-IAM-Integration-Authentication-Bypass.html

Details

Source: Mitre, NVD

Published: 2020-08-26

Updated: 2026-06-17

Named Vulnerability: GO-2022-0825Named Vulnerability: GHSA-fp52-qw33-mfmw

Risk Information

CVSS v2

Base Score: 7.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Severity: High

CVSS v3

Base Score: 8.2

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N