CVE-2020-25594

概要

参考情報

• discuss.hashicorp.com/t/hcsec-2021-03-vault-api-endpoint-allowed-enumeration-of-secrets-engine-mount-paths-without-authentication/20336 · Vendor Advisory
• security.gentoo.org/glsa/202207-01 · Third Party Advisory

vault のその他の脆弱性

• CVE-2026-5807高 7.5Vault is vulnerable to a denial-of-service condition where an unauthenticated attacker can repeatedly initiate or cancel root token generati…
• CVE-2026-5052高 8.6Vault’s PKI engine’s ACME validation did not reject local targets when issuing http-01 and tls-alpn-01 challenges. This may lead to these re…
• CVE-2026-4525高 8.8If a Vault auth mount is configured to pass through the "Authorization" header, and the "Authorization" header is used to authenticate to Va…
• CVE-2026-3605高 8.1An authenticated user with access to a kvv2 path through a policy containing a glob may be able to delete secrets they were not authorized t…
• CVE-2025-12044高 7.5Vault and Vault Enterprise (“Vault”) are vulnerable to an unauthenticated denial of service when processing JSON payloads. This occurs due t…