Improper Input Validation in HashiCorp Vault

CRITICAL 9.8CVE-2020-12757 · BIT-vault-2020-12757 · GHSA-75pc-qvwc-jf3g · Published 10/06/2020 · updated 17/06/2026

In short

CVE-2020-12757 is a CRITICAL (CVSS 9.8) vulnerability affecting github.com/hashicorp/vault-plugin-secrets-gcp, vault (hashicorp).
Chance of exploitation in the next 30 days (EPSS): 1.6%, higher than 75.2% of all vulnerabilities.
Fix: update to 0.6.2, 1.4.2 or later.

Package	Affected versions	Patched versions
github.com/hashicorp/vault-plugin-secrets-gcp Go	`< 0.6.2`	`0.6.2`
vault hashicorp	`≥ 1.4.0, < 1.4.2`	`1.4.2`

Description

HashiCorp Vault and Vault Enterprise 1.4.x before 1.4.2 in Go package github.com/hashicorp/vault-plugin-secrets-gcp/plugin has Incorrect Access Control.

NVD description

HashiCorp Vault and Vault Enterprise 1.4.0 and 1.4.1, when configured with the GCP Secrets Engine, may incorrectly generate GCP Credentials with the default time-to-live lease duration instead of the engine-configured setting. This may lead to generated GCP credentials being valid for longer than intended. Fixed in 1.4.2.

References

nvd.nist.gov/vuln/detail/CVE-2020-12757 · ADVISORY
hashicorp/vault-plugin-secrets-gcp#85 · WEB
hashicorp/vault-plugin-secrets-gcp commit e43d208 · WEB
hashicorp/vault · WEB
hashicorp/vault · WEB
hashicorp.com/blog/category/vault · WEB
hashicorp.com/blog/category/vault · Vendor Advisory
GitHub Advisory GHSA-75pc-qvwc-jf3g · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free