Improper Input Validation in HashiCorp Vault

KRITISCH 9.8CVE-2020-12757 · BIT-vault-2020-12757 · GHSA-75pc-qvwc-jf3g · Published 10/06/2020 · updated 17/06/2026

Kurz gesagt

CVE-2020-12757 ist eine Schwachstelle (KRITISCH (CVSS 9.8)) in github.com/hashicorp/vault-plugin-secrets-gcp, vault (hashicorp).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 1.6%, höher als bei 75.2% aller Schwachstellen.
Abhilfe: auf 0.6.2, 1.4.2 oder neuer aktualisieren.

Package	Affected versions	Patched versions
github.com/hashicorp/vault-plugin-secrets-gcp Go	`< 0.6.2`	`0.6.2`
vault hashicorp	`≥ 1.4.0, < 1.4.2`	`1.4.2`

Description

HashiCorp Vault and Vault Enterprise 1.4.x before 1.4.2 in Go package github.com/hashicorp/vault-plugin-secrets-gcp/plugin has Incorrect Access Control.

NVD description

HashiCorp Vault and Vault Enterprise 1.4.0 and 1.4.1, when configured with the GCP Secrets Engine, may incorrectly generate GCP Credentials with the default time-to-live lease duration instead of the engine-configured setting. This may lead to generated GCP credentials being valid for longer than intended. Fixed in 1.4.2.

References

nvd.nist.gov/vuln/detail/CVE-2020-12757 · ADVISORY
hashicorp/vault-plugin-secrets-gcp#85 · WEB
hashicorp/vault-plugin-secrets-gcp commit e43d208 · WEB
hashicorp/vault · WEB
hashicorp/vault · WEB
hashicorp.com/blog/category/vault · WEB
hashicorp.com/blog/category/vault · Vendor Advisory
GitHub Advisory GHSA-75pc-qvwc-jf3g · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

github.com/hashicorp/vault-plugin-secrets-gcp

< 0.6.2

0.6.2

vault

hashicorp

≥ 1.4.0, < 1.4.2

1.4.2

Description

HashiCorp Vault and Vault Enterprise 1.4.x before 1.4.2 in Go package github.com/hashicorp/vault-plugin-secrets-gcp/plugin has Incorrect Access Control.

NVD description